Open Redirect Vulnerability in CGI for Perl Affects Various Applications
CVE-2026-120638

Currently unrated

Key Information:

Status
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120638?

The vulnerability in CGI for Perl versions before 5.00 allows attackers to exploit open redirects through HTML entity decoding of validated URLs. This occurs when the redirect function decodes HTML entities in the URL before updating the Location header, enabling manipulation of user redirection. As a result, a previously validated URL, such as //evil.example/, may redirect users to unintended external domains like //evil.example/. This flaw poses a significant security risk, potentially leading to phishing attacks and other malicious activities. Affected users should upgrade to CGI version 5.00 or later to mitigate this vulnerability.

References

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CG...
technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes
release-notes
https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.