Unrated severityNVD Advisory· Published Nov 4, 2026

CVE-2026-120637

Description

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD.

For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and path_info from the process's command line arguments.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Perl Foundation/CGIllm-fuzzy
Range: <5.00
Leejo/CGI.pmllm-fuzzy
Range: <5.00

Patches

Vulnerability mechanics

References

github.com/leejo/CGI.pm/commit/b753ff75a3bc4554c075cc37c1db605a55297029.patchnvd
metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pmnvd
metacpan.org/release/LEEJO/CGI-5.00/changesnvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000