PT-2026-136750
CVE-2026-120643
·
Published
2026-11-03
·
Updated
2026-11-04
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self url.
Both pass the URL through URI's canonical method, which leaves an apostrophe in the path raw and decodes the %27 that query parameter escaping produces, so an apostrophe in the request path or a parameter appears raw in the result.
An application that places the URL in a single-quoted HTML attribute or JavaScript string is open to cross-site scripting.
Found an issue in the description? Have something to add? Feel free to write us 👾