DEBIAN-CVE-2026-120638: Debian/libcgi-pm-perl vulnerability
CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to control to exploit this issue?
The attacker needs influence over a URL passed to CGI's redirect handling after the application has validated it. They can use HTML entity encoding such as //evil.example/ so decoding changes it into a protocol-relative URL pointing to another host.
Are applications affected if they do not use redirects with user-controlled URLs?
The issue is in CGI redirect handling and requires a URL whose meaning can change after application validation. Applications that do not pass attacker-influenced URLs to redirect are not exposed through this behavior.
What can be done if an update is not immediately available?
Do not rely on validation performed before CGI decodes HTML entities. Reject or normalize HTML entity-encoded characters in redirect targets, and allow only expected local paths or an explicit allowlist of destination hosts.