CVE-2026-120635— CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs

Quick assessment

Affected

CVE-2026-120635

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 CGI 模块在 5.00 之前的版本中，由于 multipart 解析机制与 RFC 标准存在差异，允许表单字段绕过代理服务器和 Web 应用防火墙（WAF）。具体而言，该 multipart/form-data 解析器存在以下问题：它会在行内任意位置（而非仅行首）匹配边界分隔符；对于某些客户端提供的 User-Agent 值，它在使用边界时省略了前导的"--"；它会在其他参数的引号值内部查找 Content-Disposition 字段中的名称和文件名；此外，当边界接近 4096 字节的读取大小时

AI Predicted 9.8 Difficulty: Easy EPSS 0.20% · P10 Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
None	None	`< 5.00`	affected

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs

Source: CVE Program / CVE List V5

Vulnerability Description

CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears the 4096-byte read size.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

解释冲突

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	-	0 ~ 5.00	-

II. Public POCs for CVE-2026-120635

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120635

请登录查看更多情报信息。

Other References for CVE-2026-120635 (7)

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm technical-description
https://github.com/leejo/CGI.pm/commit/cbf04979f9974458ac223793bbd9d0b6a772aa66.patch patch
https://github.com/leejo/CGI.pm/commit/f719fc08e8756708bcd4f1e357d5c0f8702f85dd.patch patch
https://metacpan.org/release/LEEJO/CGI-5.00/changes release-notes
https://www.rfc-editor.org/rfc/rfc2046#section-5.1.1 technical-description
https://github.com/leejo/CGI.pm/commit/e0ef8f4248c6ae3025749040d8595d206b6a1b49.patch patch
https://github.com/leejo/CGI.pm/commit/fe9516804d59a3774e280c15dbb7072fbd0ba5f1.patch patch

https://www.cve.org/CVERecord?id=CVE-2026-120635

IV. Related Vulnerabilities

Same weakness: CWE-436