CVE-2026-120641

CVSS 8.8 (high) · published 2026-11-04

CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged. An application that saves the upload under this name can be made to write outside the intended directory.

Weakness: CWE-22

Source: NVD CVE-2026-120641

References

• https://github.com/leejo/CGI.pm/commit/5379eb18e87b7f985613f5c4f7bae94478a4fa2f.patch
• https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm
• https://metacpan.org/release/LEEJO/CGI-5.00/changes

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.