critical · CVSS v3 9.1

CVE-2026-120642

CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadI…

Description

CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some path_info and script_name values, Accept results, and the name lists from url_param and cookie are returned without the taint flag, as is a cookie named expires from 4.67 on. These values come from regex captures or hash keys, which Perl does not taint, so they pass -T checks unvalidated.

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.1
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-121600

The vulnerability is a stack-based buffer overflow in the MAC Filter Handler of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104. It can be triggered remotely via the addEffect parameter in cstecgi.cgi, allowing attackers to crash the device or potentially execute arbitrary code.

View analysis

critical

CVE-2026-114549

NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30685.

View analysis

critical

CVE-2026-120635

CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears the 4096-byte read size.

View analysis

critical

CVE-2026-120637

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and path_info from the process's command line arguments.

View analysis