Bug 2566605 (CVE-2026-120642)

Summary:	CVE-2026-120642 perl-cgi: perl-cgi: Security feature bypass via untainted request parameters
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in perl-cgi. When running under Perl's taint mode—a security feature that prevents untrusted data from being used in sensitive operations—the module returns several request-derived values without taint flags. A remote attacker could exploit this vulnerability by submitting crafted request parameters to bypass taint checks, potentially allowing unvalidated data to reach sensitive operations in applications that rely on taint verification.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2567310
Bug Blocks:

Description OSIDB Bzimport 2026-11-03 23:52:09 UTC

CGI versions before 5.00 for Perl return request-derived values untainted under taint mode.

The upload filename, uploadInfo values, some path_info and script_name values, Accept results, and the name lists from url_param and cookie are returned without the taint flag, as is a cookie named expires from 4.67 on.

These values come from regex captures or hash keys, which Perl does not taint, so they pass -T checks unvalidated.