CVE-2026-120644

— UNSCOREDpublic exploit available

Published 2026-11-04 · Updated 2026-11-04

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.

Weaknesses

CWE-116

Public exploit & PoC references

https://github.com/leejo/CGI.pm/commit/0b3527faaa9de55f79ca7d59dd3bcfb2c5540e00.patch

All references

https://github.com/leejo/CGI.pm/commit/0b3527faaa9de55f79ca7d59dd3bcfb2c5540e00.patch
https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Cookie.pm
https://metacpan.org/release/LEEJO/CGI-5.00/changes

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2024-12139
HIGHCVE-2026-102235
MEDIUMCVE-2026-104250PoC
HIGHCVE-2026-104368
UNSCOREDCVE-2026-104907PoC
MEDIUMCVE-2026-105244PoC
HIGHCVE-2026-105429PoC
UNSCOREDCVE-2026-105801PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.