CVE-2026-120646
CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo. uploadInfo dereferences its argument and calls its filename method without checking that it is an upload filehandle. A plain string naming a defined global variable, such as the parameter value from ?upload=0, is treated as a symbolic reference, and the method call on it dies.
| CWE | CWE-843 |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for
Be the first to know when new unknown vulnerabilities are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup