CVE-2026-7381

Katalog CVE

CVSS 9.1 · Critical EPSS 0,52%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada miyagawa plack. Skor CVSS 3.1 9.1 (Critical) menurut CISA ADP.

Deskripsi (NVD)

Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment. A malicious client can set the X-Sendfile-Type header to "X-Accel-Redirect" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server. Since 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack. This is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the "X-Accel-Redirect" type.

Rincian

Terbit di NVD

29 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
CWE-913: Improper Control of Dynamically-Managed Code Resources

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://nvd.nist.gov/vuln/detail/CVE-2025-61780 pemerintah AS
• https://metacpan.org/release/MIYAGAWA/Plack-1.0053/changes release notes
• https://metacpan.org/release/MIYAGAWA/Plack-1.0053/view/lib/Plack/Middleware/XSendfile.pm#DEPRECATION-NOTICE product