CVE-2026-120633

MediumCVSS 6.1/10Last modified Nov 9, 2026

Description

CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port.

These take the host name and port from the X-Forwarded-Host request header when present, and otherwise from Host, without validating either. The URLs from url and self_url are the default redirect location and the start_html(-base=>1) base href, and the default start_form action when REQUEST_URI is not set.

A client can poison shared caches, and URLs the application stores or sends, with redirects, links and scripts that point at a host it controls.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-348CWE-601

Affected software

No affected versions have been published.

Timeline

Published
Nov 4, 2026
Last modified
Nov 9, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1206346.5CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer. WarningsCVE-2026-1206358.1CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. CVE-2026-1206366.1CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form. url(-absCVE-2026-1206379.8CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For aCVE-2026-1206386.1CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redireCVE-2026-1206397.2CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in CVE-2026-120647.5When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer anCVE-2026-1206406.5CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or formCVE-2026-1206418.8CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returnedCVE-2026-1206429.1CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some paCVE-2026-1206436.1CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url. Both passCVE-2026-1206449.1CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domai
CVE-2026-120633: Medium severity, CVSS 6.1 | Vulnix