========================================================================
CVE-2026-120633                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-120633

  Distribution:  CGI
      Versions:  before 5.00
      MetaCPAN:  https://metacpan.org/dist/CGI
      VCS Repo:  https://github.com/leejo/CGI.pm

CGI versions before 5.00 for Perl trust the client X-Forwarded-Host
header in url, self_url, virtual_host and virtual_port

Description
-----------
CGI versions before 5.00 for Perl trust the client X-Forwarded-Host
header in url, self_url, virtual_host and virtual_port.

These take the host name and port from the X-Forwarded-Host request
header when present, and otherwise from Host, without validating
either. The URLs from url and self_url are the default redirect
location and the start_html(-base=>1) base href, and the default
start_form action when REQUEST_URI is not set.

A client can poison shared caches, and URLs the application stores or
sends, with redirects, links and scripts that point at a host it
controls.

Problem types
-------------
- CWE-348 Use of Less Trusted Source
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Workarounds
-----------
For deployments that cannot upgrade, strip X-Forwarded-Host at the web
server or proxy unless it sets the header itself, and validate Host.

Solutions
---------
Upgrade to CGI 5.00 or later.

References
----------
https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm
https://metacpan.org/release/LEEJO/CGI-5.00/changes
https://github.com/leejo/CGI.pm/commit/d76752a5e8dfd365b0fe3a0b9a7da6c054e856af.patch