CVE-2026-120638 PUBLISHED

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect

Assigner: CPANSec
Reserved: 02.11.2026 Published: 03.11.2026 Updated: 03.11.2026

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.

redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.

Product Status

Package Collection https://cpan.org/modules
Package Name CGI
Versions Default: unaffected
  • affected from 0 to 5.00 (excl.)

Workarounds

For deployments that cannot upgrade, reject redirect URLs that HTML entity decoding would change.

Solutions

Upgrade to CGI 5.00 or later.

References

Problem Types

  • CWE-180 Incorrect Behavior Order: Validate Before Canonicalize CWE
  • CWE-601 URL Redirection to Untrusted Site ('Open Redirect') CWE