CVE-2026-120638 describes an open redirect vulnerability in the Perl CGI module that is present in all versions prior to 5.00. The flaw arises because the redirect method first HTML‑entity decodes the supplied URL before writing the Location header, enabling an attacker to alter a previously validated URL. Consequently, a benign‑looking link such as "//evil.example/" is transformed into "//evil.example/", causing the client to be redirected to an arbitrary host. This flaw is categorized as a parameter tampering weakness (CWE‑180) and a URL‑redirection vulnerability (CWE‑601).

The vulnerability affects the CGI.pm Perl library versions older than 5.00, which are commonly used in Perl web applications. Any deployment that relies on these earlier releases is subject to the open‑redirect behavior described above.

No EPSS score is reported for this issue, and it is not listed in the CISA KEV catalog, so the current exploitation likelihood is unclear. The CVSS score of 6.1 indicates a moderate severity. The likely attack vector involves manipulating the redirect function by embedding encoded characters in the URL that bypass application validation after HTML‑entity decoding. Nonetheless, open redirects are frequently leveraged in phishing and click‑jacking campaigns, making the risk of credential theft or malicious site redirection significant. Without additional publicly available exploitation data, administrators should treat the vulnerability as moderate to high severity, depending on the exposure of their redirect URLs.