Is CVE-2026-120640 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120640 being exploited in the wild.

How severe is CVE-2026-120640?

Informational severity, published 4 November 2026.

How is CVE-2026-120640 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120640?

Check whether you run Perl CGI.pm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120640: CGI.pm parameter injection via reserved param names

CVE-2026-120640 · Severity: info · Published 2026-11-04

CGI.pm, a Perl library for building web applications, accepts special parameter names (POSTDATA, PUTDATA, PATCHDATA, XForms:Model) that hold the raw HTTP request body. Versions before 5.00 allow attackers to inject these parameters through HTML forms or query strings, enabling them to spoof request bodies and potentially bypass authentication or manipulate JSON endpoints without triggering browser security checks. An attacker can forge requests from a malicious website that appear to contain modified request data, tricking applications into processing attacker-supplied values as if they were the legitimate request body.

Vendors: Perl.

Quick answers

Is CVE-2026-120640 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120640 being exploited in the wild.
How severe is CVE-2026-120640?: Informational severity, published 4 November 2026.
Which products and versions are affected?: Perl CGI.pm before 5.00.
Is there a fix for CVE-2026-120640?: Yes: fixed in 5.00. Until then: Validate that the Content-Type header matches your application's expected request format (e.g., application/json) and reject requests with mismatched content types, even if parameters appear correctly formatted. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120640 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120640?: Check whether you run Perl CGI.pm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.00

Validate that the Content-Type header matches your application's expected request format (e.g., application/json) and reject requests with mismatched content types, even if parameters appear correctly formatted.

Technical details

The vulnerability is a parameter injection flaw in CGI.pm's parameter parsing logic. CGI.pm reserves POSTDATA, PUTDATA, PATCHDATA, and XForms:Model to store the raw request body, but prior to v5.00 the library also accepted these names from query strings, form fields, and multipart parts, making it impossible for an application to distinguish client-supplied spoofed values from the actual request body. This enables Cross-Site Request Forgery (CSRF) attacks without CORS preflight, as a plain HTML form can POST POSTDATA={"admin":true} to a JSON endpoint. The fix rejects client-sent parameters with these reserved names during parsing, whether from the query string, form data, or multipart uploads.

Affected products

Perl CGI.pm before 5.00

Timeline

2026-11-02: patched: Fix committed to CGI.pm repository
2026-11-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.