Live › vulnerability › CVE-2026-120646
The Perl CGI module from 4.71 before 5.00 calls a method on a string the caller controls when it should check for an upload filehandle. A crafted request parameter makes the call die, which stops the script handling that request.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Applications that run the Perl CGI module from 4.71 before 5.00 and call uploadInfo on request parameters, which is the upload path in CGI.pm. Scripts that never read uploads through CGI, or that run a newer CGI release, can skip it. The sources do not say whether default configurations are affected.
No product ranges from the sources yet.
perl -MCGI -e 'print $CGI::VERSION' to read the installed CGI module versionCGI and call sites of uploadInfo5.00 or later (per the sources; the fixed version is stated in the patch linked from the NVD entry)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo.
uploadInfo dereferences its argument and calls its filename method without checking that it is an upload filehandle. A plain string naming a defined global variable, such as the parameter value from ?upload=0, is treated as a symbolic reference, and the method call on it dies.
This page as .md · .json · in your agent: get_signal("CVE-2026-120646")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.