CVE-2026-120636 in CGI
Summary
by MITRE • 11/04/2026
CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form.
url(-absolute=>1), url(-relative=>1) and the default start_form action are built from the client-supplied REQUEST_URI without validation. The result can be protocol-relative (//evil.example), absolute-form (http://evil.example/) or contain backslashes, and url(-relative=>1) can return a javascript: URL. Links and form posts built from these URLs can go to another host.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The Common Gateway Interface implementation for Perl prior to version 5.00 contains critical input validation deficiencies that allow attackers to exploit improperly sanitized request data, specifically the REQUEST_URI environment variable. This vulnerability manifests primarily through two distinct attack vectors involving URL generation and form action construction. The core technical flaw lies in the fact that functions such as url with absolute or relative parameters, along with the default start_form action parameter, directly incorporate client-supplied input without performing adequate validation against malicious patterns. By trusting this untrusted data source, the application inadvertently becomes a conduit for redirecting users to external domains or injecting executable scripts into web pages served by the vulnerable system.
The first major impact of this vulnerability is open redirection, which occurs when an attacker crafts a URL containing protocol-relative references such as double slashes followed by a malicious domain name, or absolute URLs pointing to phishing sites. When the CGI script processes these inputs and generates links or form actions using them, it effectively hands control over navigation to the attacker. This capability facilitates sophisticated social engineering attacks where victims are lured from legitimate websites into fraudulent environments designed to steal credentials or distribute malware. The ability to generate protocol-relative URLs allows attackers to bypass simple string matching checks that might otherwise filter out http:// prefixes, making detection and prevention more challenging for legacy systems relying on basic pattern recognition rather than robust parsing logic.
Beyond redirection, the vulnerability enables script injection attacks through the generation of javascript: URIs within relative URL contexts. When url is called with the relative parameter set to one, it can return a URI scheme that triggers client-side code execution upon interaction by end users. This transforms standard web links into vectors for cross-site scripting or drive-by download attempts depending on how the resulting link is rendered and handled by the browser. The inclusion of backslashes in generated URLs further complicates parsing behavior across different browsers, potentially leading to inconsistent security controls being applied during request processing. These inconsistencies can be leveraged to bypass content security policies or other client-side mitigations that rely on predictable URL structures.
From a classification perspective, this vulnerability aligns with CWE-601, which covers URL Redirection to Untrusted Site, and CWE-79, known as Improper Neutralization of Input During Web Page Generation, commonly referred to as Cross-site Scripting. The exploitation technique maps directly to the ATT&CK framework under Tactic TA0002 Execution via Subtechnique T1189 Drive-by Client-side Code Injection or T1566 Phishing for Information through Link Manipulation. These mappings highlight how a single input validation failure can serve multiple malicious objectives ranging from credential theft to arbitrary code execution on the client side.
The operational impact extends beyond immediate security breaches, affecting user trust and organizational reputation. Victims who are redirected to phishing sites may suffer financial loss or identity theft, while those exposed to script injection might have their sessions hijacked or personal data exfiltrated without consent. For organizations running legacy Perl CGI applications, the presence of this flaw represents a significant risk exposure that cannot be mitigated through configuration changes alone due to its fundamental nature in how URLs are constructed from request metadata.
Mitigation strategies must prioritize upgrading to version 5.00 or later where these input validation issues have been addressed by developers implementing stricter sanitization routines. For systems unable to upgrade immediately, administrators should implement reverse proxy rules that inspect and sanitize REQUEST_URI values before they reach the CGI application. Additionally, code-level patches can involve explicitly validating URL schemes against an allowlist of safe protocols such as http or https while rejecting any input containing javascript:, data:, or protocol-relative formats. Implementing Content Security Policy headers with strict script-src directives can also reduce the impact of successful injection attempts by preventing unauthorized script execution in the browser context.