{"id":"CVE-2026-7381","state":"PUBLISHED","title":"Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting","description":"Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting.\n\nPlack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment.\n\nA malicious client can set the X-Sendfile-Type header to \"X-Accel-Redirect\" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server.\n\nSince 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack.\n\nThis is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the \"X-Accel-Redirect\" type.","publishedAt":"2026-04-29T22:13:35.351Z","updatedAt":"2026-04-30T13:18:45.937Z","severity":{"score":9.1,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"CISA-ADP"},"assigner":"CPANSec","products":["MIYAGAWA Plack::Middleware::XSendfile"],"affected":[{"vendor":"MIYAGAWA","product":"Plack::Middleware::XSendfile","packageName":"Plack","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.0053","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","programFiles":["lib/Plack/Middleware::XSendfile.pm"],"repo":"https://github.com/plack/Plack"}],"references":["https://metacpan.org/release/MIYAGAWA/Plack-1.0053/changes","https://metacpan.org/release/MIYAGAWA/Plack-1.0053/view/lib/Plack/Middleware/XSendfile.pm#DEPRECATION-NOTICE","https://nvd.nist.gov/vuln/detail/CVE-2025-61780"],"weaknesses":["CWE-200","CWE-441","CWE-913"],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/7xxx/CVE-2026-7381.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-7381","state":"PUBLISHED","datePublished":"2026-04-29T22:13:35.351Z","dateUpdated":"2026-04-30T13:18:45.937Z","assignerShortName":"CPANSec","assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateReserved":"2026-04-29T07:43:55.519Z"},"containers":{"cna":{"title":"Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting","descriptions":[{"lang":"en","value":"Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting.\n\nPlack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment.\n\nA malicious client can set the X-Sendfile-Type header to \"X-Accel-Redirect\" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server.\n\nSince 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack.\n\nThis is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the \"X-Accel-Redirect\" type."}],"affected":[{"vendor":"MIYAGAWA","product":"Plack::Middleware::XSendfile","packageName":"Plack","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.0053","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","programFiles":["lib/Plack/Middleware::XSendfile.pm"],"repo":"https://github.com/plack/Plack"}],"references":[{"url":"https://metacpan.org/release/MIYAGAWA/Plack-1.0053/changes","tags":["release-notes"]},{"url":"https://metacpan.org/release/MIYAGAWA/Plack-1.0053/view/lib/Plack/Middleware/XSendfile.pm#DEPRECATION-NOTICE","tags":["technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61780","tags":["related"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-441","description":"CWE-441 Unintended Proxy or Intermediary","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-913","description":"CWE-913 Improper Control of Dynamically-Managed Code Resources","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CPANSec","orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateUpdated":"2026-04-29T22:13:35.351Z"},"credits":[{"lang":"en","type":"finder","value":"CPANSec"}],"solutions":[{"lang":"en","value":"Users are encouraged to set the appropriate header directly in their applications, or write their own middleware layer that does not allow configuration to be passed via HTTP request headers."}],"source":{"discovery":"UNKNOWN"},"timeline":[{"lang":"en","time":"2025-10-10T00:00:00.000Z","value":"Issue for Rack::Sendfile reported"},{"lang":"en","time":"2026-04-27T00:00:00.000Z","value":"Issue reported to maintainer of Plack"},{"lang":"en","time":"2025-04-28T00:00:00.000Z","value":"Plack 1.0052 released with improved security documentation in Plack::Middleware::XSendfile"},{"lang":"en","time":"2025-04-29T00:00:00.000Z","value":"Plack 1.0053 released that deprecates Plack::Middleware::XSendfile"}],"workarounds":[{"lang":"en","value":"Users can configure the X-Sendfile-Type in the middleware constructor, and the reverse proxy to unset the X-Sendfile-Type header and (on nginx) the X-Accel-Mapping request header."}],"x_generator":{"engine":"cpansec-cna-tool 0.1"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-04-30T13:18:16.234435Z","id":"CVE-2026-7381","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-30T13:18:45.937Z"}}]}}}