CVE-2026-120638

A flaw was found in perl-cgi. The redirect function decodes HTML entities in target URLs before generating the HTTP Location header. A remote attacker could exploit this vulnerability by supplying a specially crafted URL containing encoded characters that bypasses application-level URL validation...