CVE-2026-120638— CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect

Quick assessment

Affected

CVE-2026-120638

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Perl 5.00 之前的 CGI 版本中，存在通过 HTML 实体解码 URL 而引发的开放重定向漏洞。具体而言，CGI 的函数在写入响应头之前，会先对 URL 中的 HTML 实体进行解码。这导致应用层已经验证过的 URL 在解码后可能改变其含义。例如，原本为的 URL 会被解码为，从而将用户重定向到另一个主机。

AI Predicted 6.5 Difficulty: Easy Updated Nov 04, 2026

Possible ATT&CK Techniques 3 AI

T1566.002 · Spearphishing Link T1055.001 · Dynamic-link Library Injection T1190 · Exploit Public-Facing Application

Updated Nov 04, 2026

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect

Source: CVE Program / CVE List V5

Vulnerability Description

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

不正确的行为次序：规范化之前验证

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	-	0 ~ 5.00	-

II. Public POCs for CVE-2026-120638

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120638

请登录查看更多情报信息。

Other References for CVE-2026-120638 (3)

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes release-notes
https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch patch

https://www.cve.org/CVERecord?id=CVE-2026-120638

IV. Related Vulnerabilities

Same weakness: CWE-180