{"id":"CVE-2026-120640","title":"CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields","summary":"CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields.\n\nCGI stores a non-form request body under POSTDATA, PUTDATA or PATCHDATA, and an XForms …","severity":"none","cwe":["CWE-352"],"product":"CGI","affected":["CGI < 5.00"],"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T23:40:33.770Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120640","references":[{"url":"https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm"},{"url":"https://metacpan.org/release/LEEJO/CGI-5.00/changes"},{"url":"https://github.com/leejo/CGI.pm/commit/bc4022f553301014e522133ba1e1f4e49e3bef08.patch"}],"tags":["cve.org"],"epss":0.00131,"epssPercentile":0.027,"ingestedAt":"2026-11-05T20:33:06.620Z","slug":"CVE-2026-120640","body":"## Overview\n\nCGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields.\n\nCGI stores a non-form request body under POSTDATA, PUTDATA or PATCHDATA, and an XForms body under XForms:Model, but also accepts these names from the query string, a form field or a multipart part, so an application cannot tell a client-sent value from the real body.\n\nA cross-site HTML form can post POSTDATA={\"admin\":true} to an endpoint that reads JSON from param('POSTDATA'), a request forgery that needs no CORS preflight.\n\n## Affected\n\n- `CGI < 5.00`\n\n## Remediation\n\nUpgrade to CGI 5.00 or later.\n\n### Workarounds\n\nFor deployments that cannot upgrade, check the request Content-Type before trusting param('POSTDATA').","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}