CVE-2026-120638: CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect

Q: What applications are exposed to this issue?

Applications using CGI for Perl versions before 5.00 are exposed if they validate a redirect URL before passing it to redirect and assume that validation remains valid when the Location header is generated.

Q: What does an attacker need to exploit it?

An attacker needs to influence a redirect URL that the application validates and then supplies to CGI's redirect function. HTML entity sequences can alter the URL after validation; for example, //evil.example/ becomes //evil.example/ and redirects to another host.

Q: Are applications that do not use redirects affected?

The described behavior is in CGI's redirect handling. Applications that do not pass attacker-influenced URLs through redirect are not described as affected.

Q: What should be done if an immediate upgrade is not possible?

Validate the URL after HTML entity decoding, or reject HTML entity sequences in redirect targets. Ensure redirect targets cannot become scheme-relative URLs such as //evil.example/ after decoding.

Published Nov 3, 2026

Updated

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.

redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.

Affected Software

4 affected components

debian/libcgi-pm-perl*

debian/libcgi-pm-perl<=4.55-1, <=4.68-1, <=4.72-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Perl CGI to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 3, 2026

CVE Published

via MITRE·11:40 PM

Data Sourced

via MITRE·11:40 PM

RemedyDescriptionWeakness

Nov 4, 2026

Data Sourced

via NVD·12:17 AM

DescriptionWeakness

Data Sourced

via OSV·12:17 AM

DescriptionAffected Software

Frequently Asked Questions

What applications are exposed to this issue?

Applications using CGI for Perl versions before 5.00 are exposed if they validate a redirect URL before passing it to redirect and assume that validation remains valid when the Location header is generated.

What does an attacker need to exploit it?

An attacker needs to influence a redirect URL that the application validates and then supplies to CGI's redirect function. HTML entity sequences can alter the URL after validation; for example, //evil.example/ becomes //evil.example/ and redirects to another host.

Are applications that do not use redirects affected?

The described behavior is in CGI's redirect handling. Applications that do not pass attacker-influenced URLs through redirect are not described as affected.

What should be done if an immediate upgrade is not possible?

Validate the URL after HTML entity decoding, or reject HTML entity sequences in redirect targets. Ensure redirect targets cannot become scheme-relative URLs such as //evil.example/ after decoding.

CVE-2026-120638: CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect

Affected Software

Remediation

Event History

Frequently Asked Questions

What applications are exposed to this issue?

What does an attacker need to exploit it?

Are applications that do not use redirects affected?

What should be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

What applications are exposed to this issue?

What does an attacker need to exploit it?

Are applications that do not use redirects affected?

What should be done if an immediate upgrade is not possible?