CVE-2026-120638

— UNSCOREDpublic exploit available

Published 2026-11-04 · Updated 2026-11-04

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.

Weaknesses

CWE-180, CWE-601

Public exploit & PoC references

https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch

All references

https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch
https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm
https://metacpan.org/release/LEEJO/CGI-5.00/changes

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2024-12141
MEDIUMCVE-2024-2372
MEDIUMCVE-2024-4989PoC
MEDIUMCVE-2024-58389PoC
MEDIUMCVE-2024-58398PoC
MEDIUMCVE-2026-100230PoC
HIGHCVE-2026-100409PoC
MEDIUMCVE-2026-100523PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.