A flaw in CGI prior to version 5.00 for Perl permits an attacker to supply malformed request bodies via query string or form fields for POSTDATA, PUTDATA, PATCHDATA, or XForms:Model. Because these parameters are also read from client‑side fields, the application cannot distinguish user‑supplied values from the genuine request body. The vulnerability enables a cross‑site request forgery that can alter application state, such as granting administrative privileges by posting POSTDATA={"admin":true}. This bypasses normal CSRF defenses and has no CORS preflight.

The vulnerability affects installations of the CGI Perl module older than 5.00. Versions 4.72 and any earlier release are impacted. Enterprises using CGI 4.x or 4.72 or earlier in a web application that processes JSON or XForms payloads are at risk.

The flaw is exploitable via a simple HTML form submission that does not require any special headers or authentication. The publicly reported CVSS score is 6.5, indicating moderate severity. Although EPSS is not available, the nature of the attack – a CSRF that needs no preflight – suggests a realistic exploitation probability for vulnerable endpoints. The vulnerability is not listed in CISA's KEV catalog, but its CSRF characteristics pose significant risk for state‑changing operations.