Bug 2566609 (CVE-2026-120638)

Summary: CVE-2026-120638 perl-cgi: perl-cgi: Open redirect via HTML entity decoding in redirect function
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in perl-cgi. The redirect function decodes HTML entities in target URLs before generating the HTTP Location header. A remote attacker could exploit this vulnerability by supplying a specially crafted URL containing encoded characters that bypasses application-level URL validation. Successful exploitation may result in an open redirect, tricking users into visiting untrusted or malicious external websites.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2567292    
Bug Blocks:    

Description OSIDB Bzimport 2026-11-03 23:52:22 UTC 
CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.

redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, /&#47;evil.example/ becomes //evil.example/ and sends the user to another host.