CVE-2026-120641
CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged. An application that saves the upload under this name can be made to write outside the intended directory.
| CWE | CWE-22 |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for
Be the first to know when new unknown vulnerabilities are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup