CVE-2026-120642

A security flaw exists in perl-cgi (CGI versions before 5.00) where request-derived values are returned without the taint flag when running under Perl's taint mode. Specifically, values such as the upload filename , uploadInfo , certain path_info and script_name values, Accept results, and name l...

CVE-2026-120642 CGI versions before 5.00 for Perl return request-derived values untainted under taint mode

CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some pathinfo and scriptname values, Accept results, and the name lists from urlparam and cookie are returned without the taint flag, as is a cookie named expires fr...