CVE-2026-120637 PUBLISHED

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD

Assigner: CPANSec
Reserved: 02.11.2026 Published: 03.11.2026 Updated: 03.11.2026

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD.

For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and path_info from the process's command line arguments.

Product Status

Package Collection https://cpan.org/modules
Package Name CGI
Versions Default: unaffected
  • affected from 0 to 5.00 (excl.)

Solutions

Upgrade to CGI 5.00 or later.

References

Problem Types

  • CWE-489 Active Debug Code CWE