CGI modules older than 5.00 for Perl incorrectly process request parameters when an unrecognized HTTP method is supplied. In such cases, the module falls back to its offline debugging mode, which is enabled by default. The fallback uses the process’s command line arguments to build parameters and path information, meaning an attacker can supply arbitrary arguments that will be interpreted as part of the CGI script’s execution context. This weakness is documented as CWE‑489 and can lead to unexpected behavior or potential command execution depending on the script’s design.

Perl web applications that use the CGI.pm module version 4.x or earlier from the LEEJO/CGI CPAN package are affected on any platform that runs them. Any environment where those modules are loaded, including legacy sites with CGI scripts, is at risk, especially if the modules are not upgraded to version 5.00 or later.

Because exploiting the flaw requires an unrecognized HTTP method such as OPTIONS and depends on the CGI module’s offline debugging mode being enabled, the attack surface is narrow. No public exploitation or EPSS score exists and the vulnerability is not in CISA KEV, suggesting a lower likelihood of widespread exploitation. Nevertheless, the potential to inject arbitrary command line arguments represents a significant risk, warranting timely remediation. The CVSS score of 6.5 indicates moderate severity.