UNKNOWNCVSS not yet scoredVulnerability
CVE-2026-120641
CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged. An application that saves the upload under this name can be made to write outside the intended directory.
Properties
- Last source
- NVD
- Nvd fetched at
- 2026-11-04T01:29:06.847378+00:00
- Cve id
- CVE-2026-120641
- First seen by Signal
- 2026-11-04T01:30:00+00:00
- Name
- CVE-2026-120641
- Retrieved at
- 2026-11-04T01:30:00+00:00
- Published at
- 2026-11-04T00:17:25.527
- Last modified
- 2026-11-04T00:17:25.527
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph