CVE-2026-120647
Description
A flaw was found in perl-cgi. A remote attacker can manipulate the filename of downloaded files by providing input containing unescaped double quotes to applications that use untrusted data for attachment names in HTTP (Hypertext Transfer Protocol) responses. Because the module does not properly escape double quotes when generating the Content-Disposition header, an attacker can inject additional parameters. This may lead to clients saving downloaded files under an attacker-controlled name or extension.
Statement
This vulnerability is rated as Moderate impact because exploitation requires a web application using perl-CGI to pass unsanitized user input into the attachment filename, and successful attacks manipulate client-side download parameters without compromising server-side security. In typical Red Hat Enterprise Linux deployments, perl-CGI is not exposed by default and is only utilized when custom CGI scripts are explicitly hosted. Additionally, user interaction is necessary to download and open any resulting file, significantly limiting the attack surface.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Understanding the Weakness (CWE)
Integrity
Technical Impact: Unexpected State
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
