Live › vulnerability › CVE-2026-120640
CGI.pm before 5.00 for Perl accepts POSTDATA, PUTDATA, PATCHDATA and XForms:Model as ordinary query or form fields, not only as real request bodies. An attacker can set these values from a cross-site HTML form, so an application reading them cannot tell client-sent data from the true body.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Applications that run the Perl CGI module and read JSON or XForms bodies through the POSTDATA, PUTDATA, PATCHDATA or XForms:Model parameters are exposed to forged cross-site requests. Applications that only read form fields or do not use these parameter names are not affected by the spoofing path described.
No product ranges from the sources yet.
perl -MCGI -e 'print $CGI::VERSION'param('POSTDATA'), param('PUTDATA'), param('PATCHDATA') or param('XForms:Model') and trusts the result5.00 or later (per the advisory's stated range)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields.
CGI stores a non-form request body under POSTDATA, PUTDATA or PATCHDATA, and an XForms body under XForms:Model, but also accepts these names from the query string, a form field or a multipart part, so an application cannot tell a client-sent value from the real body.
A cross-site HTML form can post POSTDATA={"admin":true} to an endpoint that reads JSON from param('POSTDATA'), a request forgery that needs no CORS preflight.
This page as .md · .json · in your agent: get_signal("CVE-2026-120640")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.