---
id: CVE-2026-120641
title: >-
  CGI versions before 5.00 for Perl return upload filenames with any
  client-supplied path, including ../ and Windows paths
summary: >-
  CGI versions before 5.00 for Perl return upload filenames with any
  client-supplied path, including ../ and Windows paths.


  The name returned for an uploaded file is the filename parameter of the part's
  Content-Disposition header, unchang…
severity: none
cwe:
  - CWE-22
product: CGI
affected:
  - CGI < 5.00
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T23:40:36.961Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120641'
references:
  - url: 'https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm'
  - url: 'https://metacpan.org/release/LEEJO/CGI-5.00/changes'
  - url: >-
      https://github.com/leejo/CGI.pm/commit/5379eb18e87b7f985613f5c4f7bae94478a4fa2f.patch
tags:
  - cve.org
epss: 0.00196
epssPercentile: 0.09427
ingestedAt: '2026-11-05T20:33:06.622Z'
---

## Overview

CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths.

The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged.

An application that saves the upload under this name can be made to write outside the intended directory.

## Affected

- `CGI < 5.00`

## Remediation

Upgrade to CGI 5.00 or later.

### Workarounds

For deployments that cannot upgrade, do not use the client-supplied upload filename as a path.