CVE-2026-7381 Details
Description
Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment. A malicious client can set the X-Sendfile-Type header to "X-Accel-Redirect" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server. Since 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack. This is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the "X-Accel-Redirect" type.
A vulnerability in Plack::Middleware::XSendfile, affecting versions through 1.0053, allows client-controlled path rewriting. This middleware can be exploited by sending crafted X-Sendfile-Type and X-Accel-Mapping headers, potentially leading to unauthorized access to files on the server. The issue arises when the middleware is used with an Nginx reverse proxy that does not properly validate these headers, allowing attackers to bypass proxy-level access controls and access sensitive application routes.
Users are advised to upgrade to Plack versions 1.0054 or later, where this vulnerability is addressed. For applications using Rack, upgrade to versions 2.2.20, 3.1.18, or 3.2.3, which require explicit configuration to enable 'X-Accel-Redirect'.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/MIYAGAWA/Plack-1.0053/changes | CPANSec | Release Notes |
| https://metacpan.org/release/MIYAGAWA/Plack-1.0053/view/lib/Plack/Middleware/XSendfile.pm#DEPRECATION-NOTICE | CPANSec | Product |
| https://nvd.nist.gov/vuln/detail/CVE-2025-61780 | CPANSec | US Government Resource |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | CPANSec |
| CWE-441 | Unintended Proxy or Intermediary ('Confused Deputy') | CPANSec |
| CWE-913 | Improper Control of Dynamically-Managed Code Resources | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| miyagawa plack::middleware::xsendfile | <= 1.0053 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | Initial Analysis | [email protected] |
| Apr 30, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | New CVE Received | CPANSec |