CVE-2026-120647

CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename. header-attachment = $name writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes. An application that passe...

CVE-2026-120647

A flaw was found in perl-cgi. A remote attacker can manipulate the filename of downloaded files by providing input containing unescaped double quotes to applications that use untrusted data for attachment names in HTTP Hypertext Transfer Protocol responses. Because the module does not properly...

CVE-2026-120647

CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename. header-attachment = $name writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes. An application that passe...

CVE-2026-120647 CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename

CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename. header-attachment = $name writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes. An application that passe...

CVE-2026-120647

The perl-cgi module (versions before 5.00 ) is vulnerable to a Content-Disposition parameter injection because it fails to escape double quotes when generating the header(-attachment => $name) function. A remote attacker can provide untrusted data containing unescaped double quotes to inject a...

two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversal

CVE-2026-18907 — Path Traversal in TECNO Hi Browser Download Handler Proof-of-concept for CVE-2026-18907 CVSS 7.5 High, CWE-23, a relative path-traversal vulnerability in the download file feature of TECNO Hi Browser com.talpa.hibrowser version 2.23.1.1. The browser trusted an attacker-controlled...

Better-CVE-2022-29464

Better CVE-2022-29464 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a...

CVE-2026-102212

Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server appliances allows an unauthenticated remote attacker to crash the index.cgi process via a crafted multipart/form-data POST request containing an overlong Content-Disposition...

st2-046-poc

Struts2 Content-Disposition filename null-byte variant of CVE-2017-5638 Struts2 Security Bulletin S2-046 A null byte \x00 in a request¡¯s Content-Disposition header filename field can trigger a InvalidFileNameException with the same client controlled filename string in the exception message that ...

CVE-2026-102212

Opengear IM72XX, CM71XX, and ACM70XX console server appliances are vulnerable to a heap-based buffer overflow in firmware versions 4.8.0 through 5.5.2 . An unauthenticated remote attacker can crash the index.cgi process by sending a crafted multipart/form-data POST request that includes an overlo...

WSOB

😭 WSOB CVE-2022-29464 😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464. CVE-2022-29464 details: Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a...

CVE-2020-5398

CVE-2020-5398 - RFDReflected File Download Attack for Spring MVC In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download RFD attack when it sets a “Content-Disposition” header...

GHSA-8494-F6MR-CJPV @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

Summary Content.disposition takes quadratic time when a Content-Disposition parameter contains a long token without =. One unauthenticated multipart request can block the Node.js event loop for several minutes. Details Content.disposition reads the parameters with a global regular expression in...

npm: @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

npm: @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service vulnerability discovered by ? in WordPress npm content versions = 3.0.6, = 4.0.6...

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

Summary Content.disposition takes quadratic time when a Content-Disposition parameter contains a long token without =. One unauthenticated multipart request can block the Node.js event loop for several minutes. Details Content.disposition reads the parameters with a global regular expression in...

CLEANSTART-2026-PC80984 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name

Security vulnerability affects the apache-hive package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...

CVE-2026-116268

The MIME::Field::ParamVal component in Perl (versions before 5.521 ) is vulnerable to CPU exhaustion due to inefficient regex complexity (CWE-1333 ). The issue arises when parsing Content-Type and Content-Disposition parameters; the parser scans from each ( to the next ) . If a field contains a (...

CVE-2026-116268 MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters

MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters. The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "" to the next "". In a field with no "", every "" scans to the end of the header...

Regular Expression Denial of Service (ReDoS)

Overview @hapi/content is a HTTP Content- headers parsing Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the internals.contentDispositionParamRegex regular expression in lib/index.js, used by the disposition function when parsing...

CVE-2026-46652

The Goobi viewer web application is vulnerable to a path traversal flaw in versions 24.03 to before 26.05 . The root cause exists in ExternalFilesDownloader.getFilename(), which extracts a filename from a server-supplied Content-Disposition response header and passes it to Path.resolve() without ...