CVE-2026-120646: vulnerability in CGI
CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
0Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Track
CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo.
uploadInfo dereferences its argument and calls its filename method without checking that it is an upload filehandle. A plain string naming a defined global variable, such as the parameter value from ?upload=0, is treated as a symbolic reference, and the method call on it dies.
Affected products
CGIRelated CVEs — CGI
In the same product, most dangerous first.
CVE-2026-120651—CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is setEPSS —CVE-2026-120650—CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limitsEPSS —CVE-2026-120648—CGI versions before 5.00 for Perl allow HTML injection via text containing --> in commentEPSS —CVE-2026-120647—CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filenameEPSS —CVE-2026-120645—CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_listEPSS —CVE-2026-120644—CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires valuesEPSS —