# CVE-2026-120647: Perl CGI header attachment parameter injection

Source: https://junglewise.ai/threats/cve-2026-120647-cgi-versions-before-5-00-for-perl-allow-content-disposition  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-120647 · Severity: info · Published 2026-11-04

The CGI module for Perl, a library that helps web applications generate HTTP responses, does not properly escape special characters in file attachment filenames. An attacker can inject additional HTTP header parameters by crafting a malicious filename, potentially tricking users' browsers into downloading files with different names or triggering other header-based attacks.

Technologies: [Perl CGI](https://junglewise.ai/threats/technologies/perl-cgi). Vendors: [Perl](https://junglewise.ai/threats/vendors/perl).

## Quick answers

**Is CVE-2026-120647 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120647 being exploited in the wild.

**How severe is CVE-2026-120647?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Perl CGI before 5.00.

**Is there a fix for CVE-2026-120647?** Yes: fixed in 5.00. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120647 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120647?** Check whether you run Perl CGI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.00

## Technical details

The vulnerability is a parameter injection in the Content-Disposition header caused by failure to escape double quotes and backslashes in the filename parameter. When an application passes untrusted request data to header(-attachment => $name), unescaped quotes allow an attacker to inject additional parameters (e.g., a second filename= parameter) per RFC 9110 quoted-string syntax. The fix (version 5.00+) escapes " and \ characters in the filename value.

## Affected products

- Perl CGI before 5.00

## Timeline

- 2026-11-04: disclosed
- 2026-11-02: patched

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/leejo/CGI.pm/commit/131280a5c5bc51b65797bd57ef0ee8da8468065b.patch](https://github.com/leejo/CGI.pm/commit/131280a5c5bc51b65797bd57ef0ee8da8468065b.patch)

## Related threats

- [Perl CGI infinite loop in read_postdata_putdata with disabled uploads](https://junglewise.ai/threats/cve-2026-120651-cgi-versions-before-5-00-for-perl-allow-an-infinite-loop-on-a)
- [CGI for Perl resource exhaustion via missing upload limits](https://junglewise.ai/threats/cve-2026-120650-cgi-versions-before-5-00-for-perl-allow-memory-cpu-and-disk)
- [Perl CGI HTML injection via comment delimiter](https://junglewise.ai/threats/cve-2026-120648-cgi-versions-before-5-00-for-perl-allow-html-injection-via-text)
- [Perl CGI cross-site scripting in url and self_url](https://junglewise.ai/threats/cve-2026-120643-cgi-versions-from-4-62-before-5-00-for-perl-allow-cross-site)
- [Perl CGI taint bypass via request-derived values](https://junglewise.ai/threats/cve-2026-120642-cgi-versions-before-5-00-for-perl-return-request-derived-values)