AZL-112771
Dashboard / Vulnerabilities / AZL-112771
Summary: CVE-2026-120642 affecting package perl-CGI 4.60-1
Details: CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some path_info and script_name values, Accept results, and the name lists from url_param and cookie are returned without the taint flag, as is a cookie named expires from 4.67 on. These values come from regex captures or hash keys, which Perl does not taint, so they pass -T checks unvalidated.
References: https://nvd.nist.gov/vuln/detail/CVE-2026-120642
Affected packages
Package
Name: perl-CGI
Purl: pkg:rpm/azure-linux/perl-CGI
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -None
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
