CVE-2026-120641

A flaw was found in perl-cgi. The module returns client-supplied upload filenames without sanitizing directory traversal sequences or path separators. A remote attacker can exploit this flaw by submitting a file upload with a crafted filename, potentially causing the host application to write files outside the intended destination directory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.