CVE-2026-120641
Description
A flaw was found in perl-cgi. The module returns client-supplied upload filenames without sanitizing directory traversal sequences or path separators. A remote attacker can exploit this flaw by submitting a file upload with a crafted filename, potentially causing the host application to write files outside the intended destination directory.
Statement
This vulnerability is rated as Important severity because unauthenticated remote attackers can overwrite arbitrary files with the privileges of the web server process when applications accept file uploads. In Red Hat Enterprise Linux environments, perl-CGI functions as a library rather than an exposed standalone service, meaning exposure is limited to scripts configured to handle multipart form data. Successful attacks require downstream code to directly persist files using the untrusted client-provided filename without independent sanitization or unique name generation.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to sanitize client-supplied upload filenames or canonicalize destination paths before saving files in applications using CGI.pm: upgrade to CGI 5.00+ (or the fixed Perl Cgi builds), which strip control characters and directory segments separated by forward slashes and backslashes from upload filenames, defaulting to 'upload' if no usable name remains, closing all 3 injection vectors (multipart Content-Disposition filenames with relative directory traversal sequences, multipart Content-Disposition filenames with absolute path segments, multipart Content-Disposition filenames with Windows path separators). Until patched, this is a concern on Applications on any platform using CGI.pm to handle multipart/form-data file uploads that save files under the returned filename, so Implement independent path sanitization or canonicalization in application code to ensure destination paths remain strictly confined to designated upload directories before saving files. As a compensating measure, Inspect HTTP multipart/form-data payloads with a web application firewall to detect and block traversal sequences inside the Content-Disposition filename parameter, Log kernel-level filesystem write events using auditd to provide forensic visibility when files are created outside the intended upload directory, Monitor file-system write operations with Falco or eBPF runtime security to alert on unexpected file creation outside standard upload directories by the web process, and Deploy file integrity monitoring such as AIDE to detect unauthorized creation or modification of critical system files resulting from traversal writes. These controls limit blast radius and contain exploitation, but they do not fix the underlying path traversal vulnerability — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Integrity
Technical Impact: Modify Files or Directories
The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.
Confidentiality
Technical Impact: Read Files or Directories
The attacker may be able to read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the product from working at all and in the case of protection mechanisms such as authentication, it has the potential to lock out product users.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
