Search: CVE-2026-120642

CGI versions prior to 5.00 for Perl improperly handle taint mode by returning certain request-derived values untainted. This includes upload filenames, uploadInfo values, some path_info and script_name values, Accept headers, and name lists from url_param and cookie, as well as a cookie named expires from version 4.67 onward. These values originate from regex captures or hash keys, which Perl does not taint, allowing them to bypass taint checks and remain unvalidated.