CVE-2026-120636: CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form

Q: Which applications are exposed to this issue?

Applications using Perl CGI versions before 5.00 are exposed if they generate links or form actions with url(-absolute=>1), url(-relative=>1), or start_form without an explicitly supplied action. Exposure depends on attacker-controlled REQUEST_URI reaching those generated URLs.

Published Nov 3, 2026

Updated

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUESTURI in url and startform.

url(-absolute=>1), url(-relative=>1) and the default startform action are built from the client-supplied REQUESTURI without validation. The result can be protocol-relative (//evil.example), absolute-form (http://evil.example/) or contain backslashes, and url(-relative=>1) can return a javascript: URL. Links and form posts built from these URLs can go to another host.

Affected Software

4 affected components

debian/libcgi-pm-perl*

debian/libcgi-pm-perl<=4.55-1, <=4.68-1, <=4.72-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CGI for Perl to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 3, 2026

CVE Published

via MITRE·11:40 PM

Data Sourced

via MITRE·11:40 PM

RemedyDescriptionWeakness

Data Sourced

via OSV·11:40 PM

DescriptionWeakness

Nov 4, 2026

Data Sourced

via NVD·12:17 AM

DescriptionWeakness

Data Sourced

via OSV·12:17 AM

Affected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using Perl CGI versions before 5.00 are exposed if they generate links or form actions with url(-absolute=>1), url(-relative=>1), or start_form without an explicitly supplied action. Exposure depends on attacker-controlled REQUEST_URI reaching those generated URLs.

What does an attacker need to exploit it?

An attacker needs to make the application process a crafted request URI. The vulnerable URL construction can then produce protocol-relative, absolute-form, backslash-containing, or javascript: URLs that are used in links or form submissions.

Are default form actions affected?

Yes. start_form is affected when its action is left at the default, because that default is built from the client-supplied REQUEST_URI without validation.

What can be done before upgrading?

Avoid using url(-absolute=>1) and url(-relative=>1) with request-derived URLs, and supply an explicit trusted action to start_form. Ensure generated links and form actions are restricted to expected local paths rather than using REQUEST_URI directly.

CVE-2026-120636: CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Are default form actions affected?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Are default form actions affected?

What can be done before upgrading?