CVE-2026-120638

MediumCVSS 6.1/10Last modified Nov 9, 2026

Description

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.

redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-180CWE-601

Affected software

VendorProductVersions
——< 5.00

References

Timeline

Published
Nov 4, 2026
Last modified
Nov 9, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1206397.2CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in CVE-2026-120647.5When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer anCVE-2026-1206406.5CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or formCVE-2026-1206418.8CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returnedCVE-2026-1206429.1CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some paCVE-2026-1206436.1CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url. Both passCVE-2026-1206449.1CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domaiCVE-2026-1206457.5CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list. WhCVE-2026-1206467.5CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo. CVE-2026-1206479.8CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filenamCVE-2026-1206486.1CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment. Arguments are placed between <!-- and --> withouCVE-2026-120651.8A vulnerability was identified in Groww Stock, Mutual Fund, Gold App up to 20260805 on Android. This affects an unknown part of the componen
CVE-2026-120638: Medium severity, CVSS 6.1 | Vulnix