========================================================================
CVE-2026-120644                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-120644

  Distribution:  CGI
      Versions:  before 5.00
      MetaCPAN:  https://metacpan.org/dist/CGI
      VCS Repo:  https://github.com/leejo/CGI.pm

CGI::Cookie versions before 5.00 for Perl allow cookie attribute
injection via unvalidated path, domain and expires values

Description
-----------
CGI::Cookie versions before 5.00 for Perl allow cookie attribute
injection via unvalidated path, domain and expires values.

The path, domain and expires values are written into the Set-Cookie
header without checking for semicolons or control characters.

An application that sets them from request data can be made to add
other cookie attributes, such as Domain or SameSite.

Problem types
-------------
- CWE-116 Improper Encoding or Escaping of Output

Solutions
---------
Upgrade to CGI 5.00 or later.

References
----------
https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Cookie.pm
https://metacpan.org/release/LEEJO/CGI-5.00/changes
https://github.com/leejo/CGI.pm/commit/0b3527faaa9de55f79ca7d59dd3bcfb2c5540e00.patch