CVE-2026-120635
— UNSCOREDpublic exploit availablePublished 2026-11-04 · Updated 2026-11-04
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears the 4096-byte read size.
Weaknesses
CWE-436
Public exploit & PoC references
- https://github.com/leejo/CGI.pm/commit/cbf04979f9974458ac223793bbd9d0b6a772aa66.patch
- https://github.com/leejo/CGI.pm/commit/e0ef8f4248c6ae3025749040d8595d206b6a1b49.patch
- https://github.com/leejo/CGI.pm/commit/f719fc08e8756708bcd4f1e357d5c0f8702f85dd.patch
- https://github.com/leejo/CGI.pm/commit/fe9516804d59a3774e280c15dbb7072fbd0ba5f1.patch
All references
- https://github.com/leejo/CGI.pm/commit/cbf04979f9974458ac223793bbd9d0b6a772aa66.patch
- https://github.com/leejo/CGI.pm/commit/e0ef8f4248c6ae3025749040d8595d206b6a1b49.patch
- https://github.com/leejo/CGI.pm/commit/f719fc08e8756708bcd4f1e357d5c0f8702f85dd.patch
- https://github.com/leejo/CGI.pm/commit/fe9516804d59a3774e280c15dbb7072fbd0ba5f1.patch
- https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm
- https://metacpan.org/release/LEEJO/CGI-5.00/changes
- https://www.rfc-editor.org/rfc/rfc2046#section-5.1.1
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-100351PoC
- MEDIUMCVE-2026-101019
- MEDIUMCVE-2026-106430
- HIGHCVE-2026-106505PoC
- MEDIUMCVE-2026-107825PoC
- MEDIUMCVE-2026-107835PoC
- HIGHCVE-2026-109331PoC
- HIGHCVE-2026-109428PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.