{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"CGI","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"5.00","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-120640","cwes":["CWE-352"],"description":"CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields.\n\nCGI stores a non-form request body under POSTDATA, PUTDATA or PATCHDATA, and an XForms body under XForms:Model, but also accepts these names from the query string, a form field or a multipart part, so an application cannot tell a client-sent value from the real body.\n\nA cross-site HTML form can post POSTDATA={\"admin\":true} to an endpoint that reads JSON from param('POSTDATA'), a request forgery that needs no CORS preflight.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793749233770,"publishedAt":1793749233770,"references":[{"source":"CNA: CPANSec","tags":["technical-description"],"url":"https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm"},{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/LEEJO/CGI-5.00/changes"},{"source":"CNA: CPANSec","tags":["patch"],"url":"https://github.com/leejo/CGI.pm/commit/bc4022f553301014e522133ba1e1f4e49e3bef08.patch"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to CGI 5.00 or later."},{"kind":"workaround","source":"CNA: CPANSec","text":"For deployments that cannot upgrade, check the request Content-Type before trusting param('POSTDATA')."},{"kind":"fix","source":"CNA: CPANSec","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/leejo/CGI.pm/commit/bc4022f553301014e522133ba1e1f4e49e3bef08.patch"}],"revision":"af234b45d87309798b68e34d6fe9d188b7b58884ad4319f0163e5f48c7eaa7ae","sources":[{"modifiedAt":1793749233770,"name":"CNA: CPANSec","retrievedAt":1793750978636,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120640"}],"ssvc":null,"status":"published","title":"CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields","updatedAt":1793750978636}