CVE-2026-120640

The Perl CGI module (versions before 5.00 ) is vulnerable to a request forgery flaw. The root cause is that the module fails to distinguish between actual request body payloads and user-supplied parameters because it accepts the names POSTDATA, PUTDATA, PATCHDATA, and XForms:Model from query stri...

CVE-2026-120640 CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields

CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields. CGI stores a non-form request body under POSTDATA, PUTDATA or PATCHDATA, and an XForms body under XForms:Model, but also accepts these names from th...