CVE-2026-120642 CGI versions before 5.00 for Perl return request-derived values untainted under taint mode
CriticalCVSS 9.1
EPSS 0.42%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CGI versions before 5.00 for Perl return request-derived values untainted under taint mode.
The upload filename, uploadInfo values, some path_info and script_name values, Accept results, and the name lists from url_param and cookie are returned without the taint flag, as is a cookie named expires from 4.67 on.
These values come from regex captures or hash keys, which Perl does not taint, so they pass -T checks unvalidated.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libcgi-pm-perl(Debian:12) | All versions | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | All versions | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | All versions | No fix listed |
| cpan CGI | < 5.00 | 5.00 |
| debian/libcgi-pm-perl(Debian:12) | = 4.55-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.57-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.59-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.60-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.61-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.62-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.63-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.64-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.65-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.66-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.67-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.68-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.70-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.71-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.72-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 5.02-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | = 4.68-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | = 4.70-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | = 4.71-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | = 4.72-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | = 5.02-1 | No fix listed |
Show 16 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libcgi-pm-perl(Debian:14) | = 4.68-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 4.70-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 4.71-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 4.72-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 5.02-1 | No fix listed |
| ubuntu/libcgi-pm-perl(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/libcgi-pm-perl(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libcgi-pm-perl(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/libcgi-pm-perl(Ubuntu:26.10) | All versions | No fix listed |
| redhat/perl-CGI(Red Hat:enterprise_linux:10.3) | < 4.61-5.el10_3.1 | 4.61-5.el10_3.1 |
| redhat/perl-CGI(Red Hat:enterprise_linux_eus:10.2) | < 4.61-5.el10_2.1 | 4.61-5.el10_2.1 |
| redhat/perl-CGI(Red Hat:enterprise_linux:9) | < 4.51-5.el9_9.1 | 4.51-5.el9_9.1 |
| redhat/perl-CGI(Red Hat:rhel_eus:9.8) | < 4.51-5.el9_8.1 | 4.51-5.el9_8.1 |
| redhat/perl-CGI(Red Hat:rhel_els:7) | All versions | No fix listed |
| redhat/perl-CGI(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| azure linux perl-CGI(Azure Linux:3.0) | All versions | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- Release Notes vendor-advisory
- Debian Security Tracker CVE-2026-120642 vendor-advisory
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2566605 issue-tracking
- www.cve.org
- nvd.nist.gov
- github.com patch
- metacpan.org technical-description
- metacpan.org release-notes
- Ubuntu CVE tracker vendor-advisory
- RHSA-2026:99214 patch vendor-advisory
- RHSA-2026:99212 patch vendor-advisory
- RHSA-2026:99215 patch vendor-advisory
- RHSA-2026:99213 patch vendor-advisory