SecBoard
Zurück zur CVE-Übersicht

CVE-2026-120641

HIGH(8.8)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score22/100 — NIEDRIG
  • CVSS 8.8 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.5%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.8

Technische Schwere

Beschreibung

CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged. An application that saves the upload under this name can be made to write outside the intended directory.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • CGI versions before 5.00 for Perl

Threat-Hunting-Queries

Detect attempts to upload files with path traversal sequences in their filenames. This requires logging of file upload filenames, which might not be standard for all web server configurations.

Sentinel/Defender KQL

DeviceFileEvents
| where InitiatingProcessCommandLine contains "CGI.pm" and FileName matches regex @"\.\.[\\/]|/|\\"

Splunk SPL

index=* (sourcetype=web OR sourcetype=access_combined) uri_path=* (filename="../" OR filename="..\\" OR filename="/" OR filename="\\")

Sigma

title: CGI.pm Path Traversal Upload
author: SecBoard
logsource:
  category: webserver
  service: access_logs
detection:
  selection:
    uri_path|contains: 
      - '../'
      - '..\\'
      - '/'
      - '\\'
  condition: selection
falsepositives:
  - Legitimate file uploads with unusual but non-malicious characters (unlikely)
level: high

Elastic ES|QL

from logs-webserver.*
| where url.path : "../" or url.path : "..\\" or url.path : "/" or url.path : "\\"

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen