CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect
Summary
| CVE | CVE-2026-120638 |
|---|---|
| State | PUBLISHED |
| Assigner | CPANSec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-04 00:17:25 UTC |
| Updated | 2026-11-04 18:42:35 UTC |
| Description | CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host. |
Risk And Classification
Problem Types: CWE-180 | CWE-601 | CWE-180 CWE-180 Incorrect Behavior Order: Validate Before Canonicalize | CWE-601 CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
There are no known software configurations currently associated with this CVE in NVD or the CVE Program record.
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| metacpan.org/release/LEEJO/CGI-5.00/changes | 9b29abf9-4ab0-4765-b253-1875cd9b441e | metacpan.org | |
| github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.... | 9b29abf9-4ab0-4765-b253-1875cd9b441e | github.com | |
| metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm | 9b29abf9-4ab0-4765-b253-1875cd9b441e | metacpan.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Upgrade to CGI 5.00 or later.
Workarounds
CNA: For deployments that cannot upgrade, reject redirect URLs that HTML entity decoding would change.
There are currently no legacy QID mappings associated with this CVE.