CGI for Perl versions before 5.00 parse multipart/form‑data in a manner that does not adhere to RFC 2046. The parser accepts boundary delimiters that appear anywhere in the payload, may omit the required leading double dashes for certain User‑Agent values, and extracts the name and filename from quoted values of unrelated parameters. When the boundary approaches the 4096‑byte read limit, the parser can corrupt request parts. These deviations allow attackers to construct multipart requests that contain form fields not detected by upstream edge proxies or Web Application Firewalls, effectively injecting data that would normally be rejected. The vulnerability represents a control‑data handling flaw (CWE‑436) and enables the insertion of form fields that bypass upstream controls.

The LEEJO CGI module for Perl with any release older than 5.00 is affected. Any Perl‑based web application that imports this module directly or indirectly via other libraries or frameworks may be at risk unless it has migrated to a fixed release. Because the module is widely used for parsing form data, many sites that rely on it remain susceptible.

Exploitation requires only network access to send an HTTP POST request with a crafted multipart body; no credentials or privileged context are needed. The EPSS score is not available and the vulnerability is not included in CISA’s KEV catalog, so the documented prevalence of exploitation is unknown. The likely attack vector is an attacker originating from the network perimeter constructing malicious multipart requests that pass through proxies or WAFs and reach the CGI parser. If such a request is processed, the server may accept injected data that bypasses upstream controls.