CVE-2026-120638None▾ SunlitCGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.
redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.
CGI < 5.00Upgrade to CGI 5.00 or later.
For deployments that cannot upgrade, reject redirect URLs that HTML entity decoding would change.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120639NoneCGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push
CVE-2026-120636NoneCGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form
CVE-2026-120633NoneCGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port
CVE-2026-120650NoneCGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits
CVE-2026-120641NoneCGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths
CVE-2026-120640NoneCGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields