{"id":"CVE-2026-120647","kind":"vulnerability","aliases":["CVE-2026-120647"],"related":[],"title":"Perl CGI: unescaped quotes let attachment filenames be spoofed","description":"CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename.\n\nheader(-attachment => $name) writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes.\n\nAn application that passes request data as the attachment name can be made to send a second filename parameter, changing the name the response is saved under.","summary":"The Perl CGI module before 5.00 does not escape double quotes when it writes an attachment filename into the Content-Disposition header. An attacker who controls the attachment name can add a second filename parameter and change the name a browser saves the response under.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cgi","package","perl","web-apps"],"not_affected_if":["cgi-5.00-or-later","fixed-attachment-names"],"how_to_check":"- Look for `CGI` in the Perl module list, for example `perl -MCGI -e 'print $CGI::VERSION'`\n- Search the codebase for `header(-attachment` calls that pass request data as the name","fix":"- Perl CGI: move to `5.00` or later","status":"open","published_at":"2026-11-04T00:17:26+00:00","first_seen_at":"2026-11-04T00:46:17+00:00","triaged_at":"2026-11-04T00:48:07+00:00","updated_at":"2026-11-04T00:48:07+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T00:48:07Z","model":"claude-haiku-5-5","output":{"fix":"- Perl CGI: move to `5.00` or later","reach":"internet","title":"Perl CGI: unescaped quotes let attachment filenames be spoofed","impact":"low","summary":"The Perl CGI module before 5.00 does not escape double quotes when it writes an attachment filename into the Content-Disposition header. An attacker who controls the attachment name can add a second filename parameter and change the name a browser saves the response under.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","cgi","web-apps"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Browser saves a download under an attacker-chosen filename","analyst_note":"","how_to_check":"- Look for `CGI` in the Perl module list, for example `perl -MCGI -e 'print $CGI::VERSION'`\n- Search the codebase for `header(-attachment` calls that pass request data as the name","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-attachment-names","cgi-5.00-or-later"],"who_is_affected":"Applications that pass user-supplied or request data as the attachment name to the CGI header() call with -attachment. Applications that only use fixed attachment names, or that do not use header(-attachment), are not exposed by this flaw.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000663,"input_tokens":4158,"output_tokens":494,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120647':12A,15A '-2026':11A,14A '5.00':27B,70C 'add':53B 'allow':73C 'app':21B 'applic':107C 'attach':6A,37B,50B,86C,89C,114C 'attack':46B 'browser':63B 'cgi':2A,16B,24B,67C 'chang':59B,125C 'content':42B,75C,100C 'content-disposit':41B,74C,99C 'control':48B 'cve':10A,13A 'data':111C 'disposit':43B,76C,101C 'doubl':31B,81C,104C 'escap':30B,103C 'filenam':7A,38B,56B,87C,96C,123C 'header':44B,85C,88C 'inject':78C 'let':5A 'made':118C 'modul':25B 'name':51B,61B,90C,92C,115C,127C 'packag':17B 'paramet':57B,77C,97C,124C 'pass':109C 'perl':1A,18B,23B,72C 'quot':4A,32B,82C,95C,105C 'request':110C 'respons':66B,129C 'save':64B,131C 'second':55B,122C 'send':120C 'spoof':9A 'unescap':3A,80C 'version':68C 'via':79C 'web':20B 'web-app':19B 'without':102C 'write':35B,91C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass user-supplied or request data as the attachment name to the CGI header() call with -attachment. Applications that only use fixed attachment names, or that do not use header(-attachment), are not exposed by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cgi","low","package","perl","webapps"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120647","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120647","severity":null,"published_at":"2026-11-04T00:17:26+00:00","modified_at":"2026-11-04T00:17:26+00:00","first_seen_at":"2026-11-04T00:46:17+00:00","fetched_at":"2026-11-04T00:46:17+00:00","note":null}],"documents":[{"id":62127,"url":"https://github.com/leejo/CGI.pm/commit/131280a5c5bc51b65797bd57ef0ee8da8468065b.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}