header(-attachment => $name) writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes.
An application that passes request data as the attachment name can be made to send a second filename parameter, changing the name the response is saved under.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to CGI 5.00 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 04 Nov 2026 00:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename. header(-attachment => $name) writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes. An application that passes request data as the attachment name can be made to send a second filename parameter, changing the name the response is saved under. | |
| Title | CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename | |
| Weaknesses | CWE-116 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-03T23:41:05.454Z
Reserved: 2026-11-02T17:45:23.639Z
Link: CVE-2026-120647
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-04T00:17:26.260
Modified: 2026-11-04T00:17:26.260
Link: CVE-2026-120647
Redhat
No data.
OpenCVE Enrichment
No data.