# CVE-2026-120638: CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect

Status: published. Published: 2026-11-03. Updated: 2026-11-03.

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.

redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.

## Remediation

- fix: Upgrade to CGI 5.00 or later. (source: CNA: CPANSec)
- workaround: For deployments that cannot upgrade, reject redirect URLs that HTML entity decoding would change. (source: CNA: CPANSec)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: CPANSec) — https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch

## Affected products and versions

-  /  (CGI): ≥ 0; < 5.00 (affected, custom). Source: CNA: CPANSec

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-180, CWE-601

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm (CNA: CPANSec; technical-description)

- https://metacpan.org/release/LEEJO/CGI-5.00/changes (CNA: CPANSec; release-notes)

- https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch (CNA: CPANSec; patch)

## Provenance

- CNA: CPANSec: https://www.cve.org/CVERecord?id=CVE-2026-120638; retrieved 2026-11-04; source updated 2026-11-03

Revision: 3e383de007f27018d2e4c5a9aaba41244832b7943b8e91fa953057cb65e3bed7

Canonical: https://y2.dev/cve/CVE-2026-120638

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.