Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116132— HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk

Quick assessment

Affected
CVE-2026-116132
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 HTTP::Body 模块在 1.23_01 版本之前存在漏洞：当发生不完整的 multipart（多部分）上传时，其生成的临时文件会被遗留在磁盘上。 具体而言，multipart 解析器在文件部分开始上传时就会立即创建临时文件，但仅在该部分上传完成后才将其加入上传列表。上传列表中的文件只能通过 cleanup 选项或由调用方主动清理来删除。因此，若上传过程在文件部分尚未结束时终止，该临时文件将留在磁盘上且无法被后续机制发现或清理。 远程攻击者可利用此漏洞，通过重复发起此类不完整上传请求，使临时目录迅

AI Predicted 5.9 Difficulty: Easy

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 1.23_01 affected

I. Basic Information for CVE-2026-116132

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk
Source: CVE Program / CVE List V5
Vulnerability Description
HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk. The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by the cleanup option or by the caller, so a body that ends inside a file part leaves its temporary file where nothing can find it. A remote attacker can fill the temporary directory by repeating such requests, leaving one file behind for each.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
清理环节不完整
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 1.23_01 -

II. Public POCs for CVE-2026-116132

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116132

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-116132 (1)

Vendor Pages for CVE-2026-116132 (1)

Other References for CVE-2026-116132 (1)

IV. Related Vulnerabilities

Same weakness: CWE-459