CVE-2026-120647 CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename
CriticalCVSS 9.8
EPSS 0.52%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename.
header(-attachment => $name) writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes.
An application that passes request data as the attachment name can be made to send a second filename parameter, changing the name the response is saved under.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libcgi-pm-perl(Debian:12) | All versions | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | All versions | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | All versions | No fix listed |
| redhat/perl-CGI(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/perl-CGI(Red Hat:rhel_els:7) | All versions | No fix listed |
| redhat/perl-CGI(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/perl-CGI(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| cpan CGI | < 5.00 | 5.00 |
| debian/libcgi-pm-perl(Debian:12) | = 4.55-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.57-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.59-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.60-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.61-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.62-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.63-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.64-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.65-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.66-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.67-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.68-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.70-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.71-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.72-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 5.02-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | = 4.68-1 | No fix listed |
Show 14 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libcgi-pm-perl(Debian:13) | = 4.70-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | = 4.71-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | = 4.72-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | = 5.02-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 4.68-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 4.70-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 4.71-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 4.72-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 5.02-1 | No fix listed |
| ubuntu/libcgi-pm-perl(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/libcgi-pm-perl(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libcgi-pm-perl(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/libcgi-pm-perl(Ubuntu:26.10) | All versions | No fix listed |
| azure linux perl-CGI(Azure Linux:3.0) | All versions | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- Release Notes vendor-advisory
- Debian Security Tracker CVE-2026-120647 vendor-advisory
- Red Hat CVE page vendor-advisory
- Red Hat Bugzilla 2566610 issue-tracking
- www.cve.org
- nvd.nist.gov
- github.com patch
- metacpan.org technical-description
- metacpan.org release-notes
- Ubuntu CVE tracker vendor-advisory