CVE-2026-120644 — Vulnerability intelligence
—
Published:
- CVSS
- Not available
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values.
The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters.
An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.