---
id: CVE-2026-120638
title: >-
  CGI versions before 5.00 for Perl allow open redirects via HTML entity
  decoding of the URL after application validation in redirect
summary: >-
  CGI versions before 5.00 for Perl allow open redirects via HTML entity
  decoding of the URL after application validation in redirect.


  redirect decodes HTML entities in its URL before writing the Location header,
  so a URL the application …
severity: none
cwe:
  - CWE-180
  - CWE-601
product: CGI
affected:
  - CGI < 5.00
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T23:40:27.142Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120638'
references:
  - url: 'https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm'
  - url: 'https://metacpan.org/release/LEEJO/CGI-5.00/changes'
  - url: >-
      https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch
tags:
  - cve.org
epss: 0.00181
epssPercentile: 0.07715
ingestedAt: '2026-11-05T20:33:06.616Z'
---

## Overview

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.

redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, /&#47;evil.example/ becomes //evil.example/ and sends the user to another host.

## Affected

- `CGI < 5.00`

## Remediation

Upgrade to CGI 5.00 or later.

### Workarounds

For deployments that cannot upgrade, reject redirect URLs that HTML entity decoding would change.