CVE-2026-120637 — Vulnerability intelligence

—

Published: 2026-11-04T00:17:24.997

CVSS

Not available

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and path_info from the process's command line arguments.

Sources

• CVE-2026-120637
• Original advisory
• Original advisory
• Original advisory