Live › vulnerability › CVE-2026-120647
The Perl CGI module before 5.00 does not escape double quotes when it writes an attachment filename into the Content-Disposition header. An attacker who controls the attachment name can add a second filename parameter and change the name a browser saves the response under.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Applications that pass user-supplied or request data as the attachment name to the CGI header() call with -attachment. Applications that only use fixed attachment names, or that do not use header(-attachment), are not exposed by this flaw.
No product ranges from the sources yet.
CGI in the Perl module list, for example perl -MCGI -e 'print $CGI::VERSION'header(-attachment calls that pass request data as the name5.00 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename.
header(-attachment => $name) writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes.
An application that passes request data as the attachment name can be made to send a second filename parameter, changing the name the response is saved under.
This page as .md · .json · in your agent: get_signal("CVE-2026-120647")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.