CVE-2026-120636

A flaw was found in perl-cgi. The component constructs target URLs and form actions from client-supplied request values without sufficient validation. A remote attacker can exploit this flaw by sending a specially crafted request URI (Uniform Resource Identifier) containing arbitrary domains or script schemes. This vulnerability may allow an attacker to execute arbitrary scripts in a victim's web browser or redirect users to malicious external websites.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.