PT-2026-136743
CVE-2026-120636
·
Published
2026-11-03
·
Updated
2026-11-04
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST URI in url and start form.
url(-absolute=>1), url(-relative=>1) and the default start form action are built from the client-supplied REQUEST URI without validation. The result can be protocol-relative (//evil.example), absolute-form (http://evil.example/) or contain backslashes, and url(-relative=>1) can return a javascript: URL. Links and form posts built from these URLs can go to another host.
Found an issue in the description? Have something to add? Feel free to write us 👾