Open Redirect and Script Injection Vulnerability in Perl CGI Versions
CVE-2026-120636

Currently unrated

Key Information:

Status
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120636?

The Perl CGI module prior to version 5.00 is vulnerable to open redirect and script injection attacks. Specifically, the URLs generated using client-supplied REQUEST_URI in functions like url(-absolute=>1) and url(-relative=>1) lack proper validation. This oversight can lead to redirected requests to malicious websites, allowing attackers to exploit the parameters provided in these URLs. Notably, malicious links or forms may include protocol-relative or backslash-injected URLs, which can generate links to external hosts, compromising the security of the web application relying on these CGI functionalities.

References

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CG...
technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes
release-notes
https://github.com/leejo/CGI.pm/commit/9405ef3909ee94991a...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.