---
id: "CVE-2026-120638"
kind: "vulnerability"
aliases: ["CVE-2026-120638"]
title: "Perl CGI: redirect decodes HTML entities, sending users to other hosts"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cgi", "package", "perl", "web-apps"]
not_affected_if: ["no-user-controlled-redirects", "version-5.00-or-later"]
published_at: "2026-11-04T00:17:25+00:00"
first_seen_at: "2026-11-04T00:46:16+00:00"
updated_at: "2026-11-04T00:48:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120638", "first_seen_at": "2026-11-04T00:46:16+00:00"}]
---

# Perl CGI: redirect decodes HTML entities, sending users to other hosts

The Perl CGI module, before version 5.00, decodes HTML entities in a redirect URL after the application has validated it. An attacker can craft a link that passes the check but sends the user to a different external site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `CGI` in Perl dependencies, for example with `perl -MCGI -e 'print $CGI::VERSION'`
- Check whether the application calls `redirect` from the CGI module with user-supplied URLs

## Fix

- Move the Perl CGI module to `5.00` or later (per the sources; confirm against the release)

## Timeline

- 2026-11-04T00:46:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120638

## Documents

- [fix] Patch: github.com https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch

## From the sources

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.

redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_