CGI.pm versions before 5.00 trust a client‑supplied X‑Forwarded‑Host header when constructing URLs in functions such as url, self_url, virtual_host, and virtual_port without validation. These generated URLs are used as redirect destinations, the base href for HTML output, and the default form action. As a result, an attacker can supply a forged host value that will be embedded in these URLs. The application will then store or send URLs that point to an attacker‑controlled domain, enabling cache poisoning and forced navigation to malicious sites.

Any deployment that uses the Perl CGI.pm library older than version 5.00, including web applications written in Perl that rely on CGI.pm for URL generation, base href setting, and form action handling.

The flaw can be exploited remotely via standard HTTP or HTTPS requests. An attacker with network visibility can craft a request containing a malicious X‑Forwarded‑Host header; the likely attack vector is a crafted HTTP request from an external client. Because the vulnerability does not require authentication or privileged access, it is broadly exploitable. EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 6.1 indicates moderate severity. The remote nature of the exploit enables widespread cache poisoning or forced navigation to attacker‑controlled domains, representing a high‑risk impact on confidentiality and integrity of cached content and user traffic.