CGI.pm versions prior to 5.00 return the exact filename supplied by a client in a file upload request, including directory traversal characters such as "../" or Windows path separators; if an application stores the upload using this returned value, an attacker can write a file outside the intended directory, enabling arbitrary file creation or overwriting. The potential for configuration tampering or code deployment is inferred from the nature of the filesystem write but is not explicitly stated in the CVE description.

Any Perl‑based web application that uses CGI.pm earlier than 5.00 to handle file uploads and stores the upload directly under the supplied filename is affected; this includes legacy scripts and custom applications that have not upgraded to newer CGI library releases and do not sanitize the filename parameter.

The vulnerability has a CVSS score of 7.5, EPSS score not available, and is not listed in the CISA KEV catalog. It permits direct filesystem manipulation via a straightforward network‑based file upload attack vector. Based on the CVSS score and attack vector, the risk is high for affected systems, but this assessment is inferred from the provided metrics.