CVE-2026-7381

{"id": "CVE-2026-7381", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7381", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-30T13:18:16.234435Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/plack/Plack", "vendor": "MIYAGAWA", "product": "Plack::Middleware::XSendfile", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.0053"}], "packageName": "Plack", "programFiles": ["lib/Plack/Middleware::XSendfile.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}]}], "published": "2026-04-29T23:16:19.897", "references": [{"url": "https://metacpan.org/release/MIYAGAWA/Plack-1.0053/changes", "tags": ["Release Notes"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/MIYAGAWA/Plack-1.0053/view/lib/Plack/Middleware/XSendfile.pm#DEPRECATION-NOTICE", "tags": ["Product"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61780", "tags": ["US Government Resource"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-441"}, {"lang": "en", "value": "CWE-913"}]}], "descriptions": [{"lang": "en", "value": "Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting.\n\nPlack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment.\n\nA malicious client can set the X-Sendfile-Type header to \"X-Accel-Redirect\" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server.\n\nSince 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack.\n\nThis is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the \"X-Accel-Redirect\" type."}, {"lang": "es", "value": "Las versiones de Plack::Middleware::XSendfile hasta la 1.0053 para Perl pueden permitir la reescritura de rutas controlada por el cliente.\n\nPlack::Middleware::XSendfile permite que la configuraci\u00f3n de variaci\u00f3n (tipo de sendfile) sea establecida por el cliente a trav\u00e9s del encabezado X-Sendfile-Type, si no se considera en el constructor del middleware o en el entorno de Plack.\n\nUn cliente malicioso puede establecer el encabezado X-Sendfile-Type en \u2019X-Accel-Redirect\u2019 para servicios que se ejecutan detr\u00e1s de proxies inversos de nginx, y luego establecer el X-Accel-Mapping para mapear la ruta a un archivo arbitrario en el servidor.\n\nDesde la 1.0053, Plack::Middleware::XSendfile est\u00e1 obsoleto y ser\u00e1 eliminado de futuras versiones de Plack.\n\nEsto es similar a CVE-2025-61780 para Rack::Sendfile, aunque Plack::Middleware::XSendfile tiene algunas mitigaciones que no permiten que se utilicen expresiones regulares en el mapeo, y solo aplican el mapeo para el tipo \u2019X-Accel-Redirect\u2019."}], "lastModified": "2026-10-26T20:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:miyagawa:plack\\:\\:middleware\\:\\:xsendfile:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "29005B5E-82D5-4EB7-8387-D831C6963F11", "versionEndIncluding": "1.0053"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}