---
id: CVE-2026-120647
title: >-
  CGI versions before 5.00 for Perl allow Content-Disposition parameter
  injection via unescaped double quotes in the header attachment filename
summary: >-
  CGI versions before 5.00 for Perl allow Content-Disposition parameter
  injection via unescaped double quotes in the header attachment filename.


  header(-attachment => $name) writes $name into the quoted filename parameter
  of Content-Dispo…
severity: none
cwe:
  - CWE-116
product: CGI
affected:
  - CGI < 5.00
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T23:41:05.454Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120647'
references:
  - url: 'https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm'
  - url: 'https://metacpan.org/release/LEEJO/CGI-5.00/changes'
  - url: >-
      https://github.com/leejo/CGI.pm/commit/131280a5c5bc51b65797bd57ef0ee8da8468065b.patch
tags:
  - cve.org
epss: 0.00205
epssPercentile: 0.10632
ingestedAt: '2026-11-05T20:33:06.618Z'
---

## Overview

CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename.

header(-attachment => $name) writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes.

An application that passes request data as the attachment name can be made to send a second filename parameter, changing the name the response is saved under.

## Affected

- `CGI < 5.00`

## Remediation

Upgrade to CGI 5.00 or later.