CGI versions before 5.00 for Perl contain a vulnerability in their multipart/form-data parser that allows form fields to be smuggled past proxies and web application firewalls (WAFs). This occurs because the parser matches boundaries incorrectly, uses boundaries without the leading '--' for certain User-Agent values, misinterprets Content-Disposition parameters, and corrupts parts near the 4096-byte read size.