External risk intelligence

Perl CGI Content-Disposition Header Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-120647

The vulnerability exists in the CGI module for Perl, which is frequently used to build dynamic web applications and public-facing APIs. Because this module is commonly utilized to handle HTTP request data and generate web responses, the affected functionality is typically exposed to the public internet in standard web server deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in a common web development module for Perl could allow an attacker to manipulate how files are named when downloaded from a web application, potentially leading to further security issues. The main concern is to confirm if our environment uses this module and is exposed to this risk.

File name control flaw in web software.
Confirms if our systems are affected.
Understand exposure, ensure correct use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by sending a specially crafted request to a web application that uses the vulnerable CGI module. If the application incorporates user-supplied data into the `Content-Disposition` header's filename parameter without proper sanitization, the attacker can inject a second filename. This manipulation can influence how the web server or browser handles the response, potentially leading to unexpected behavior or further compromise.

No authentication or special privileges needed.
Filename in `Content-Disposition` header.
Can lead to unintended file handling.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in CGI for Perl could allow an attacker to inject parameters into the Content-Disposition header, potentially altering how a response is saved by the user's browser when supported by the advisory.

Response filename may be manipulated.
Filename injection could occur from untrusted input.
User's browser may save files with unexpected names.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are most likely to address this vulnerability. The first practical step is to identify all instances of the affected CGI module, determine their exposure and business criticality, and then coordinate remediation efforts with the accountable teams, potentially involving vendor coordination for updates.

Identify CGI module instances.
Confirm exposure and criticality.
Plan remediation with owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the CGI module for Perl?

The CGI module is a long-standing library for the Perl programming language used to create dynamic web content. Developers use it to process incoming HTTP requests and generate the corresponding web responses, such as building HTML forms or handling file downloads in web applications.

What does CWE-116 mean for CVE-2026-120647?

CWE-116 refers to improper encoding of output for a specific output medium. In this case, the CGI library fails to neutralize double quotes within a filename. Because these quotes are not escaped, an attacker can break out of the intended filename parameter and inject additional content into the Content-Disposition header.

How does an attacker trigger this vulnerability?

An attacker triggers this by providing malicious input that an application then passes directly into the attachment name field of a header. The bug does not trigger if the application validates or sanitizes user input before passing it to the CGI module's header function, nor does it trigger if the application uses hard-coded filenames.

Why should I care about this if my app is internal?

Halo Surface Signal indicates that this module is frequently used for public-facing APIs and web interfaces, meaning the vulnerability is often reachable from the internet. Even if an app is internal, you should care if the system processes untrusted data from network users, as this could allow them to manipulate file download behaviors.

How do I start addressing CVE-2026-120647?

Begin by auditing your codebase to locate where the CGI module generates file download headers. Once identified, evaluate if those locations incorporate unvalidated user input into the filename parameter. Finally, plan to update to version 5.00 or later of the CGI module to receive the necessary fix for this header injection flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.