CVE-2026-120646

— UNSCOREDpublic exploit available

Published 2026-11-04 · Updated 2026-11-04

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo. uploadInfo dereferences its argument and calls its filename method without checking that it is an upload filehandle. A plain string naming a defined global variable, such as the parameter value from ?upload=0, is treated as a symbolic reference, and the method call on it dies.

Weaknesses

CWE-843

Public exploit & PoC references

https://github.com/leejo/CGI.pm/commit/a14a7decfdc18f2daf436d30df9b543e3f0f8da3.patch

All references

https://github.com/leejo/CGI.pm/commit/a14a7decfdc18f2daf436d30df9b543e3f0f8da3.patch
https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm
https://metacpan.org/release/LEEJO/CGI-5.00/changes

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-0314
HIGHCVE-2026-100792
MEDIUMCVE-2026-100793
UNSCOREDCVE-2026-101912PoC
HIGHCVE-2026-102203
HIGHCVE-2026-102216
HIGHCVE-2026-102299
HIGHCVE-2026-102321

Related by shared AI tags and CWE weakness class. Browse the full archive.