CVE-2026-120633

A flaw was found in perl-CGI. This vulnerability allows a remote attacker to conduct web cache poisoning or redirect users to malicious websites by sending crafted Hypertext Transfer Protocol (HTTP) requests with untrusted host headers. Because the module trusts client-provided headers such as X-Forwarded-Host to construct internal addresses and redirects without proper validation, an attacker can manipulate generated links to point to an external system under their control.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.