Most recent entries from all

fkie_cve-2026-120641

2026-11-08T23:40:19.642351+00:00

CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths.

The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged.

An application that saves the upload under this name can be made to write outside the intended directory.

GHSA-3hqq-f8xf-6qwx

2026-11-08T23:40:19.642422+00:00

CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths.

The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged.

An application that saves the upload under this name can be made to write outside the intended directory.

msrc_CVE-2026-120641 — CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths

2026-11-08T23:40:19.642444+00:00

msrc_CVE-2026-120641

openSUSE-SU-2026:12465-1 — perl-CGI-5.20.0-1.1 on GA media

2026-11-08T23:40:19.642464+00:00

perl-CGI-5.20.0-1.1 on GA media

UBUNTU-CVE-2026-120641

2026-11-08T23:40:19.642484+00:00

Affected: Ubuntu:16.04:LTS: libcgi-pm-perl, Ubuntu:18.04:LTS: libcgi-pm-perl, Ubuntu:20.04:LTS: libcgi-pm-perl, Ubuntu:22.04:LTS: libcgi-pm-perl, Ubuntu:24.04:LTS: libcgi-pm-perl, Ubuntu:26.10: libcgi-pm-perl, Ubuntu:26.04:LTS: libcgi-pm-perl

CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged. An application that saves the upload under this name can be made to write outside the intended directory.