CVE-2026-120641 in CGI
Summary
by MITRE • 11/04/2026
CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths.
The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged.
An application that saves the upload under this name can be made to write outside the intended directory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
CGI.pm versions prior to 5.00 contain a critical path traversal vulnerability stemming from how the module handles file uploads in Perl environments. The core technical flaw lies in the fact that CGI.pm returns the upload filename exactly as provided by the client within the Content-Disposition header of the HTTP request, without performing any sanitization or validation on the path components. This behavior allows an attacker to supply arbitrary directory traversal sequences, such as ../ for Unix-like systems or backslashes and drive letters like C:\Windows\ for Windows-based servers, directly in the filename field during a multipart form submission. Because the module treats this input as literal text rather than validating it against safe character sets or resolving relative paths before returning them to the application logic, the vulnerability is inherent to the library's design decision to preserve client-supplied metadata without restriction.
The operational impact of this flaw is severe when web applications rely on CGI.pm for handling file uploads and subsequently save these files using the returned filename directly into a specific directory structure. If an application takes the unvalidated string from CGI.pm and concatenates it with a base upload path, such as /var/www/uploads/, an attacker can craft a request where the filename is ../../etc/passwd or C:\boot.ini. When the application writes this file to disk, the operating system interprets the traversal sequences, causing the data to be written outside the intended sandboxed directory and potentially overwriting critical system files or placing malicious scripts in web-accessible locations. This can lead to remote code execution if a scriptable file is placed in an executable path, information disclosure through the reading of sensitive configuration files, or denial of service via disk space exhaustion or permission errors on protected directories.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-73: External Control of File Name or Path within the Common Weakness Enumeration framework. From an offensive security perspective, it is categorized under ATT&CK technique T1508: Exploitation for Defense Evasion, specifically through path manipulation techniques that allow attackers to bypass intended access controls and write files in unauthorized locations. The root cause is a failure to enforce strict input validation on user-supplied file paths before they are used by the operating system's file I/O functions.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. Organizations should immediately upgrade CGI.pm to version 5.00 or later, where this specific behavior has been addressed with stricter handling of upload filenames. For applications that cannot be upgraded instantly, developers must implement rigorous input validation by stripping all path traversal characters such as dots, slashes, and backslashes from the filename before using it in file operations. Additionally, implementing a whitelist approach for allowed file extensions and ensuring that files are saved to a randomized or hashed directory structure can further reduce the risk of successful exploitation. It is also recommended to use modern web frameworks that abstract away low-level CGI handling and enforce secure defaults for file uploads, thereby reducing the attack surface associated with manual path manipulation vulnerabilities.