{"id":"CVE-2026-120638","kind":"vulnerability","aliases":["CVE-2026-120638"],"related":[],"title":"Perl CGI: redirect decodes HTML entities, sending users to other hosts","description":"CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.\n\nredirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.","summary":"The Perl CGI module, before version 5.00, decodes HTML entities in a redirect URL after the application has validated it. An attacker can craft a link that passes the check but sends the user to a different external site.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cgi","package","perl","web-apps"],"not_affected_if":["no-user-controlled-redirects","version-5.00-or-later"],"how_to_check":"- Look for `CGI` in Perl dependencies, for example with `perl -MCGI -e 'print $CGI::VERSION'`\n- Check whether the application calls `redirect` from the CGI module with user-supplied URLs","fix":"- Move the Perl CGI module to `5.00` or later (per the sources; confirm against the release)","status":"open","published_at":"2026-11-04T00:17:25+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","triaged_at":"2026-11-04T00:48:19+00:00","updated_at":"2026-11-04T00:48:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T00:48:19Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Perl CGI module to `5.00` or later (per the sources; confirm against the release)","reach":"internet","title":"Perl CGI: redirect decodes HTML entities, sending users to other hosts","impact":"low","summary":"The Perl CGI module, before version 5.00, decodes HTML entities in a redirect URL after the application has validated it. An attacker can craft a link that passes the check but sends the user to a different external site.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","cgi","web-apps"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"users redirected to attacker-chosen external sites for phishing","analyst_note":"Confirm the affected version range and the fixed release from the NVD entry and the linked patch before relying on the 5.00 fix.","how_to_check":"- Look for `CGI` in Perl dependencies, for example with `perl -MCGI -e 'print $CGI::VERSION'`\n- Check whether the application calls `redirect` from the CGI module with user-supplied URLs","plain_action":"","needs_analyst":true,"not_affected_if":["version-5.00-or-later","no-user-controlled-redirects"],"who_is_affected":"Applications that use the Perl CGI module's redirect function with URLs that include user input after validation. Scripts that never redirect to user-supplied URLs, or that use a newer version, are not exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000682,"input_tokens":4143,"output_tokens":536,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120638':14A,17A '-2026':13A,16A '/evil.example':111C '5.00':30B,66C 'allow':69C 'alreadi':102C 'anoth':117C 'app':23B 'applic':40B,80C,100C 'attack':45B 'becom':110C 'cgi':2A,18B,26B,63C 'chang':105C 'check':53B 'craft':47B 'cve':12A,15A 'decod':4A,31B,75C,85C 'differ':60B 'entiti':6A,33B,74C,87C 'evil.example':109C 'exampl':108C 'extern':61B 'header':95C 'host':11A,118C 'html':5A,32B,73C,86C 'link':49B 'locat':94C 'mean':106C 'modul':27B 'open':70C 'packag':19B 'pass':51B 'perl':1A,20B,25B,68C 'redirect':3A,36B,71C,83C,84C 'send':7A,55B,113C 'site':62B 'url':37B,78C,90C,98C 'user':8A,57B,115C 'valid':42B,81C,103C 'version':29B,64C 'via':72C 'web':22B 'web-app':21B 'write':92C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Perl CGI module's redirect function with URLs that include user input after validation. Scripts that never redirect to user-supplied URLs, or that use a newer version, are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cgi","medium","package","perl","webapps"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120638","severity":null,"published_at":"2026-11-04T00:17:25+00:00","modified_at":"2026-11-04T00:17:25+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","fetched_at":"2026-11-04T00:46:16+00:00","note":null}],"documents":[{"id":62117,"url":"https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}