CVE-2026-120647

A flaw was found in perl-cgi. A remote attacker can manipulate the filename of downloaded files by providing input containing unescaped double quotes to applications that use untrusted data for attachment names in HTTP (Hypertext Transfer Protocol) responses. Because the module does not properly escape double quotes when generating the Content-Disposition header, an attacker can inject additional parameters. This may lead to clients saving downloaded files under an attacker-controlled name or extension.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.