UBUNTU-CVE-2026-120642

    Dashboard / Vulnerabilities / UBUNTU-CVE-2026-120642

    UBUNTU-CVE-2026-120642

    Published: 4 Nov 2026Last Modified: 5 Nov 2026
    Upstream:
    CVE-2026-120642

    Summary:

    Details: CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some path_info and script_name values, Accept results, and the name lists from url_param and cookie are returned without the taint flag, as is a cookie named expires from 4.67 on. These values come from regex captures or hash keys, which Perl does not taint, so they pass -T checks unvalidated.

    References: https://ubuntu.com/security/CVE-2026-120642, https://www.cve.org/CVERecord?id=CVE-2026-120642, https://lists.security.metacpan.org/cve-announce/msg/44874935/, https://github.com/leejo/CGI.pm/commit/6ae50ce84073b8f68a6e3750479de70d5b8f2dcf, https://github.com/leejo/CGI.pm/commit/6ae50ce84073b8f68a6e3750479de70d5b8f2dcf.patch, https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm, https://metacpan.org/release/LEEJO/CGI-5.00/changes

    Affected packages

    Package

    Name: libcgi-pm-perl

    Purl: pkg:deb/ubuntu/libcgi-pm-perl?arch=source&distro=xenial

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    4.21-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2026-120642 | CVE-DB