Bug 2566610 (CVE-2026-120647)

Summary: CVE-2026-120647 perl-cgi: perl-cgi: Content-Disposition parameter injection via unescaped double quotes in attachment filenames
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in perl-cgi. A remote attacker can manipulate the filename of downloaded files by providing input containing unescaped double quotes to applications that use untrusted data for attachment names in HTTP (Hypertext Transfer Protocol) responses. Because the module does not properly escape double quotes when generating the Content-Disposition header, an attacker can inject additional parameters. This may lead to clients saving downloaded files under an attacker-controlled name or extension.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2567290    
Bug Blocks:    

Description OSIDB Bzimport 2026-11-03 23:52:27 UTC 
CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename.

header(-attachment => $name) writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes.

An application that passes request data as the attachment name can be made to send a second filename parameter, changing the name the response is saved under.