========================================================================
CVE-2026-120638                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-120638

  Distribution:  CGI
      Versions:  before 5.00
      MetaCPAN:  https://metacpan.org/dist/CGI
      VCS Repo:  https://github.com/leejo/CGI.pm

CGI versions before 5.00 for Perl allow open redirects via HTML entity
decoding of the URL after application validation in redirect

Description
-----------
CGI versions before 5.00 for Perl allow open redirects via HTML entity
decoding of the URL after application validation in redirect.

redirect decodes HTML entities in its URL before writing the Location
header, so a URL the application has already validated can change
meaning. For example, //evil.example/ becomes //evil.example/ and
sends the user to another host.

Problem types
-------------
- CWE-180 Incorrect Behavior Order: Validate Before Canonicalize
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Workarounds
-----------
For deployments that cannot upgrade, reject redirect URLs that HTML
entity decoding would change.

Solutions
---------
Upgrade to CGI 5.00 or later.

References
----------
https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm
https://metacpan.org/release/LEEJO/CGI-5.00/changes
https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch