CVE-2026-120641: CVE-2026-120641: dizin geçişi

Açıklama (NVD)

CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged. An application that saves the upload under this name can be made to write outside the intended directory.

Özet bilgiler

EPSS

%0,20 (yüzdelik 9)

CWE

CWE-22

Yama

Yok / bilinmiyor

Kaynaklar

• NVD kaydı
• github.com
• metacpan.org
• metacpan.org
• CWE-22