DEBIAN-CVE-2026-120643: Debian/libcgi-pm-perl vulnerability
CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and selfurl. Both pass the URL through URI's canonical method, which leaves an apostrophe in the path raw and decodes the %27 that query parameter escaping produces, so an apostrophe in the request path or a parameter appears raw in the result. An application that places the URL in a single-quoted HTML attribute or JavaScript string is open to cross-site scripting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perl CGIto a version that resolves this vulnerability.Fixed in 5.00
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using affected CGI versions and calling url or self_url are exposed only if they insert the returned URL into a single-quoted HTML attribute or JavaScript string without safe context-appropriate escaping.
What does an attacker need to do to exploit it?
An attacker needs to send a request containing an apostrophe in the URL path or in a parameter, and cause the application to reflect the value returned by url or self_url in a vulnerable single-quoted HTML or JavaScript context.
Are applications safe if they do not use single-quoted output contexts?
The described cross-site scripting condition specifically requires the returned URL to be placed in a single-quoted HTML attribute or JavaScript string. Applications that do not place these values in those contexts are not described as vulnerable by the available information.
What can be done if upgrading is not immediately possible?
Avoid placing values returned by url or self_url directly in single-quoted HTML attributes or JavaScript strings. Apply context-appropriate output escaping before rendering those values.