CVE-2026-120640

A flaw was found in perl-cgi. This vulnerability allows a remote attacker to conduct request forgery by spoofing internal request body parameters through query strings or form fields. Because the module does not distinguish between actual request payloads and user-supplied parameters, an attacker can submit crafted input that the application mistakenly processes as a legitimate request body.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.