Live › vulnerability › CVE-2026-120641
CGI.pm versions before 5.00 return the filename of an uploaded file exactly as the client sent it, including ../ sequences and Windows paths. An application that saves uploads under that name can be tricked into writing files outside its intended directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Applications that use the Perl CGI module to accept file uploads and save them using the client-supplied filename are exposed. Applications that do not handle file uploads, or that generate their own storage names, are not affected by this flaw.
No product ranges from the sources yet.
perl -MCGI -e 'print $CGI::VERSION'5.00 or later (per the NVD description)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths.
The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged.
An application that saves the upload under this name can be made to write outside the intended directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-120641")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.