CVE-2026-120641 PUBLISHED

CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths

Assigner: CPANSec
Reserved: 02.11.2026 Published: 03.11.2026 Updated: 03.11.2026

CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths.

The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged.

An application that saves the upload under this name can be made to write outside the intended directory.

Product Status

Package Collection https://cpan.org/modules
Package Name CGI
Versions Default: unaffected
  • affected from 0 to 5.00 (excl.)

Workarounds

For deployments that cannot upgrade, do not use the client-supplied upload filename as a path.

Solutions

Upgrade to CGI 5.00 or later.

References

Problem Types

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE