Description
CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.

redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.
Published: 2026-11-03
Score: n/a
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Upgrade to CGI 5.00 or later.

Vendor Workaround

For deployments that cannot upgrade, reject redirect URLs that HTML entity decoding would change.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 00:00:00 +0000

Type Values Removed Values Added
Description CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.
Title CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect
Weaknesses CWE-180
CWE-601
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: CPANSec

Published:

Updated: 2026-11-03T23:40:27.142Z

Reserved: 2026-11-02T17:40:51.554Z

Link: CVE-2026-120638

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-04T00:17:25.137

Modified: 2026-11-04T00:17:25.137

Link: CVE-2026-120638

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-180

    Incorrect Behavior Order: Validate Before Canonicalize

  • CWE-601

    URL Redirection to Untrusted Site ('Open Redirect')