CVE-2026-120633 Details
Description
CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port. These take the host name and port from the X-Forwarded-Host request header when present, and otherwise from Host, without validating either. The URLs from url and self_url are the default redirect location and the start_html(-base=>1) base href, and the default start_form action when REQUEST_URI is not set. A client can poison shared caches, and URLs the application stores or sends, with redirects, links and scripts that point at a host it controls.
A vulnerability exists in CGI versions prior to 5.00 for Perl, where the client-supplied X-Forwarded-Host header is trusted and used to determine the virtual host and port for several CGI methods. This unvalidated header can be exploited to manipulate URLs in a way that creates open redirects or poisons shared caches with malicious links or scripts.
Users can upgrade to CGI version 5.00 or later, where this vulnerability has been fixed. Instructions for upgrading can be found in the CGI release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/leejo/CGI.pm/commit/d76752a5e8dfd365b0fe3a0b9a7da6c054e856af.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm | CPANSec | Source CodeVendor |
| https://metacpan.org/release/LEEJO/CGI-5.00/changes | CPANSec | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-348 | Use of Less Trusted Source | CPANSec |
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| CGI | < 5.00 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | CPANSec |