CVE-2026-120638 in CGI
Summary
by MITRE • 11/04/2026
CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.
redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The Common Gateway Interface (CGI) module for Perl, specifically versions prior to 5.00, contains a critical logic flaw related to URL handling during redirection operations. This vulnerability stems from an improper sequence of operations within the redirect function, where HTML entity decoding is applied to the target URL after initial validation checks have already been performed by the application or script developer. The core technical issue lies in the fact that the CGI module decodes entities such as / (which represents a forward slash) into their literal character equivalents before setting the HTTP Location header. This post-validation decoding allows an attacker to manipulate the URL structure in ways that bypass security controls designed to restrict redirections to trusted domains or paths.
In a typical secure implementation, developers validate the redirect target against a whitelist of allowed hosts or ensure it is a relative path within the same domain before executing the redirect. However, because the CGI module performs HTML entity decoding on the URL string after this validation step has occurred, an attacker can supply a payload like //evil.example/ which appears to be a safe relative path during the initial check. Once decoded by the CGI module, this string transforms into //evil.example/, which is interpreted by web browsers as a protocol-relative absolute URL pointing to an external domain. This discrepancy between the validated state and the executed state creates a classic open redirect vulnerability that undermines application-level access controls.
The operational impact of this flaw allows attackers to conduct phishing attacks with high credibility, as users are redirected from a trusted domain to a malicious site while maintaining the appearance of legitimacy in the browser address bar initially or through social engineering tactics. This can lead to credential theft, malware distribution, and session hijacking if combined with other attack vectors such as cross-site scripting or cookie stealing. The vulnerability affects any web application using Perl CGI scripts that rely on this module for handling redirects without implementing additional client-side validation or avoiding the use of HTML entities in redirect targets entirely.
Mitigation strategies should focus on ensuring that URL decoding occurs before validation checks, thereby preventing attackers from obfuscating malicious URLs through entity encoding. Developers must also consider validating the final decoded URL against a strict allowlist of permitted hosts rather than relying solely on structural checks like relative path verification. Upgrading to CGI version 5.00 or later resolves this issue by correcting the order of operations and ensuring that security controls are applied consistently before any transformation of user-supplied input is executed in redirect contexts.