{"api_version":"1","generated_at":"2026-11-04T20:56:27+00:00","cve":"CVE-2026-120638","urls":{"html":"https://cve.report/CVE-2026-120638","api":"https://cve.report/api/cve/CVE-2026-120638.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-120638","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-120638"},"summary":{"title":"CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect","description":"CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.\n\nredirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.","state":"PUBLISHED","assigner":"CPANSec","published_at":"2026-11-04 00:17:25","updated_at":"2026-11-04 18:42:35"},"problem_types":["CWE-180","CWE-601","CWE-180 CWE-180 Incorrect Behavior Order: Validate Before Canonicalize","CWE-601 CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"],"metrics":[],"references":[{"url":"https://metacpan.org/release/LEEJO/CGI-5.00/changes","name":"https://metacpan.org/release/LEEJO/CGI-5.00/changes","refsource":"9b29abf9-4ab0-4765-b253-1875cd9b441e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch","name":"https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch","refsource":"9b29abf9-4ab0-4765-b253-1875cd9b441e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm","name":"https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm","refsource":"9b29abf9-4ab0-4765-b253-1875cd9b441e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-120638","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120638","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Upgrade to CGI 5.00 or later.","time":"","lang":"en"}],"workarounds":[{"source":"CNA","title":"","value":"For deployments that cannot upgrade, reject redirect URLs that HTML entity decoding would change.","time":"","lang":"en"}],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["CGI"],"packageName":"CGI","packageURL":"pkg:cpan/CGI","programFiles":["lib/CGI.pm"],"programRoutines":[{"name":"CGI::redirect"}],"repo":"https://github.com/leejo/CGI.pm","versions":[{"lessThan":"5.00","status":"affected","version":"0","versionType":"custom"}]}],"descriptions":[{"lang":"en","value":"CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.\n\nredirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-180","description":"CWE-180 Incorrect Behavior Order: Validate Before Canonicalize","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-601","description":"CWE-601 URL Redirection to Untrusted Site ('Open Redirect')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-03T23:40:27.142Z","orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","shortName":"CPANSec"},"references":[{"tags":["technical-description"],"url":"https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm"},{"tags":["release-notes"],"url":"https://metacpan.org/release/LEEJO/CGI-5.00/changes"},{"tags":["patch"],"url":"https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch"}],"solutions":[{"lang":"en","value":"Upgrade to CGI 5.00 or later."}],"source":{"discovery":"UNKNOWN"},"title":"CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect","workarounds":[{"lang":"en","value":"For deployments that cannot upgrade, reject redirect URLs that HTML entity decoding would change."}],"x_generator":{"engine":"cpansec-cna-tool 0.1"}}},"cveMetadata":{"assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","assignerShortName":"CPANSec","cveId":"CVE-2026-120638","datePublished":"2026-11-03T23:40:27.142Z","dateReserved":"2026-11-02T17:40:51.554Z","dateUpdated":"2026-11-03T23:40:27.142Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-04 00:17:25","lastModifiedDate":"2026-11-04 18:42:35","problem_types":["CWE-180","CWE-601","CWE-180 CWE-180 Incorrect Behavior Order: Validate Before Canonicalize","CWE-601 CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"120638","Ordinal":"1","Title":"CGI versions before 5.00 for Perl allow open redirects via HTML ","CVE":"CVE-2026-120638","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"120638","Ordinal":"1","NoteData":"CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.\n\nredirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.","Type":"Description","Title":"CGI versions before 5.00 for Perl allow open redirects via HTML "}]}}}