CVE-2026-120642
Description
A flaw was found in perl-cgi. When running under Perl's taint mode—a security feature that prevents untrusted data from being used in sensitive operations—the module returns several request-derived values without taint flags. A remote attacker could exploit this vulnerability by submitting crafted request parameters to bypass taint checks, potentially allowing unvalidated data to reach sensitive operations in applications that rely on taint verification.
Statement
Red Hat has evaluated this vulnerability as Important because it compromises Perl's core taint security boundary in environments where perl-CGI is deployed to handle untrusted web requests. While exploitation depends on scripts explicitly enforcing taint checks and passing affected parameter fields into privileged execution paths, this failure allows unauthenticated remote attackers to bypass trust restrictions. The perl-CGI component is not active by default in Red Hat Enterprise Linux and is limited to systems where legacy CGI scripts are configured.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce strict allowlist validation on all CGI request parameters and upload metadata before passing them into sensitive operations: upgrade to CGI 5.00 (or the fixed Perl Cgi builds), which append a tainted substring to request-derived hash keys and regex capture values before returning them, closing all 5 injection vectors (crafted upload filenames, crafted uploadInfo header values, crafted path_info or script_name values, crafted Accept header values, crafted url_param or cookie names). Until patched, this is a concern on applications running under Perl taint mode (-T) that rely on taint verification for CGI request metadata and parameter keys, so audit and explicitly untaint or validate all request metadata, file upload headers, and parameter names before passing them to sensitive functions like open or system. As a compensating measure, use direct process execution without shell invocation when passing CGI-derived values to process sinks, validate and sanitize upload filenames and uploadInfo headers against strict extension and content allowlists before processing, run SELinux in enforcing mode to confine the web server and CGI process domain, and apply enforcing AppArmor profiles to restrict file access and process execution for CGI scripts. These controls limit blast radius and contain exploitation, but they do not fix the underlying taint-check bypass defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
