Unrated severityNVD Advisory· Published Nov 4, 2026
CVE-2026-120641
CVE-2026-120641
Description
CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths.
The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged.
An application that saves the upload under this name can be made to write outside the intended directory.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <5.00
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.