# CVE-2026-120641: CGI for Perl path traversal in upload filenames

Source: https://junglewise.ai/threats/cve-2026-120641-cgi-versions-before-5-00-for-perl-return-upload-filenames-with  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-120641 · Severity: info · Published 2026-11-04

CGI is a web development library for Perl used to build dynamic web applications. An attacker can craft a file upload with a path traversal payload (like "../../etc/passwd" or "C:\windows\system32\config") and if an application saves the upload using the filename CGI returns, files can be written outside the intended directory, potentially overwriting application files or system files.

## Quick answers

**Is CVE-2026-120641 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120641 being exploited in the wild.

**How severe is CVE-2026-120641?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** CGI before 5.00.

**Is there a fix for CVE-2026-120641?** Yes: fixed in CGI 5.00. Until then: Set $CGI::SANITIZE_UPLOAD_FILENAMES = 1 (the new default), or generate your own safe filenames instead of using the client-supplied name directly when saving uploads. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120641 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120641?** Check whether you run CGI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in CGI 5.00

Set $CGI::SANITIZE_UPLOAD_FILENAMES = 1 (the new default), or generate your own safe filenames instead of using the client-supplied name directly when saving uploads.

## Technical details

CGI.pm returns the raw Content-Disposition filename parameter from client uploads without sanitization, allowing path traversal sequences and Windows absolute paths. An application that uses param() to retrieve the upload filename and passes it directly to file operations is vulnerable. The fix (v5.00) removes directory path components and control characters from the filename before return.

## Affected products

- CGI before 5.00

## Timeline

- 2026-11-04: disclosed
- 2026-11-02: patched

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/leejo/CGI.pm/commit/5379eb18e87b7f985613f5c4f7bae94478a4fa2f.patch](https://github.com/leejo/CGI.pm/commit/5379eb18e87b7f985613f5c4f7bae94478a4fa2f.patch)