DEBIAN-CVE-2026-120636: Debian/libcgi-pm-perl vulnerability
CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUESTURI in url and startform. url(-absolute=>1), url(-relative=>1) and the default startform action are built from the client-supplied REQUESTURI without validation. The result can be protocol-relative (//evil.example), absolute-form (http://evil.example/) or contain backslashes, and url(-relative=>1) can return a javascript: URL. Links and form posts built from these URLs can go to another host.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perl CGIto a version that resolves this vulnerability.Fixed in 5.00
Event History
Frequently Asked Questions
Are applications using the default form action affected?
Yes. The default action generated by start_form is built from the client-supplied REQUEST_URI without validation in affected CGI versions before 5.00.
What must an attacker be able to control to exploit this issue?
The attacker needs to supply a request whose REQUEST_URI is used to generate links or form actions. Crafted request targets can produce protocol-relative, absolute-form, backslash-containing, or, for url(-relative=>1), javascript: URLs.
How can I identify potentially affected code?
Look for use of url(-absolute=>1), url(-relative=>1), or start_form, including start_form calls that rely on its default action. These constructs are affected when running a CGI version before 5.00.