CVE-2026-120644 | CPANSec CGI-Cookie up to 4.x Set-Cookie Header lib/CGI/Cookie.pm path/domain/expires injection

November 4, 2026 Yanac

A vulnerability classified as critical has been found in CPANSec CGI-Cookie up to 4.x. Impacted is an unknown function of the file lib/CGI/Cookie.pm of the component Set-Cookie Header. The manipulation of the argument path/domain/expires leads to injection.

This vulnerability is traded as CVE-2026-120644. It is possible to initiate the attack remotely. There is no exploit available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More