[<prev] [next>] [day] [month] [year] [list]
Message-ID: <b8d9f060-6e83-42a5-8d34-4b34fe19b97f@cpansec.org>
Date: Wed, 29 Apr 2026 23:15:19 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-7381: Plack::Middleware::XSendfile versions through 1.0053
for Perl can allow client-controlled path rewriting
========================================================================
CVE-2026-7381 CPAN Security Group
========================================================================
CVE ID: CVE-2026-7381
Distribution: Plack
Versions: through 1.0053
MetaCPAN: https://metacpan.org/dist/Plack
VCS Repo: https://github.com/plack/Plack
Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow
client-controlled path rewriting
Description
-----------
Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow
client-controlled path rewriting.
Plack::Middleware::XSendfile allows the variation setting (sendfile
type) to be set by the client via the X-Sendfile-Type header, if it is
not considered in the middleware constructor or the Plack environment.
A malicious client can set the X-Sendfile-Type header to
"X-Accel-Redirect" to services running behind nginx reverse proxies,
and then set the X-Accel-Mapping to map the path to an arbitrary file
on the server.
Since 1.0053, Plack::Middleware::XSendfile is deprecated and will be
removed from future releases of Plack.
This is similar to CVE-2025-61780 for Rack::Sendfile, although
Plack::Middleware::XSendfile has some mitigations that disallow regular
expressions to be used in the mapping, and only apply the mapping for
the "X-Accel-Redirect" type.
Problem types
-------------
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-441 Unintended Proxy or Intermediary
- CWE-913 Improper Control of Dynamically-Managed Code Resources
Workarounds
-----------
Users can configure the X-Sendfile-Type in the middleware constructor,
and the reverse proxy to unset the X-Sendfile-Type header and (on
nginx) the X-Accel-Mapping request header.
Solutions
---------
Users are encouraged to set the appropriate header directly in their
applications, or write their own middleware layer that does not allow
configuration to be passed via HTTP request headers.
References
----------
https://metacpan.org/release/MIYAGAWA/Plack-1.0053/changes
https://metacpan.org/release/MIYAGAWA/Plack-1.0053/view/lib/Plack/Middleware/XSendfile.pm#DEPRECATION-NOTICE
https://nvd.nist.gov/vuln/detail/CVE-2025-61780
Timeline
--------
- 2025-10-10: Issue for Rack::Sendfile reported
- 2026-04-27: Issue reported to maintainer of Plack
- 2025-04-28: Plack 1.0052 released with improved security
documentation in Plack::Middleware::XSendfile
- 2025-04-29: Plack 1.0053 released that deprecates
Plack::Middleware::XSendfile
Credits
-------
CPANSec, finder
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
