Vulnerability · Published Nov 3, 2026 · Assigned by CPANSec
CVE-2026-120637CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD
Unrated
In plain English
A security flaw in CGI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS )–Not rated
Exploit odds (30 days)0.2%top 91.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and path_info from the process's command line arguments.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libcgi-pm-perl | no fix listed | DEBIAN-CVE-2026-120637 |
| Debian:13 | libcgi-pm-perl | no fix listed | DEBIAN-CVE-2026-120637 |
| Debian:14 | libcgi-pm-perl | no fix listed | DEBIAN-CVE-2026-120637 |
| Ubuntu:22.04:LTS | libcgi-pm-perl | no fix listed | UBUNTU-CVE-2026-120637 |
| Ubuntu:24.04:LTS | libcgi-pm-perl | no fix listed | UBUNTU-CVE-2026-120637 |
| Ubuntu:26.04:LTS | libcgi-pm-perl | no fix listed | UBUNTU-CVE-2026-120637 |
| Ubuntu:26.10 | libcgi-pm-perl | no fix listed | UBUNTU-CVE-2026-120637 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CGI | 0 – before 5.00 |
Weakness: CWE-489