Client Header Vulnerability in CGI for Perl by Leejo
CVE-2026-120633

Currently unrated

Key Information:

Status
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120633?

CGI versions prior to 5.00 for Perl exhibit a vulnerability where they trust the client-supplied X-Forwarded-Host header without adequate validation. This permits an attacker to manipulate URL generation by injecting malicious hostnames and ports via the X-Forwarded-Host header. The application can therefore produce invalid redirects, links, and scripts, potentially leading to malicious content being served from a host controlled by the attacker. It is crucial for users of affected versions to upgrade to mitigate these risks.

References

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CG...
technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes
release-notes
https://github.com/leejo/CGI.pm/commit/d76752a5e8dfd365b0...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.