PT-2026-36018 · Unknown · Plack::Middleware::Xsendfile

Cpansec · Published 2026-04-29 · Updated 2026-05-18 · CVE-2026-7381

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Plack::Middleware::XSendfile versions prior to 1.0053

Description Plack::Middleware::XSendfile allows the variation setting (sendfile type) to be controlled by the client via the X-Sendfile-Type header if it is not defined in the middleware constructor or the Plack environment. A malicious client can set the X-Sendfile-Type header to "X-Accel-Redirect" for services behind nginx reverse proxies and use the X-Accel-Mapping header to map the path to an arbitrary file on the server, enabling client-controlled path rewriting.

Recommendations Update to a version later than 1.0053, as Plack::Middleware::XSendfile is deprecated since version 1.0053 and will be removed from future releases of Plack.

Fix

Information Disclosure

Weakness Enumeration

CWE-441

CWE-913

CWE-200

Related Identifiers

CVE-2026-7381

Affected Products

Plack::Middleware::Xsendfile

References · 18

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-7381 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-7381 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-7381 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61780 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-7381 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-7381 · Security Note
• https://ubuntu.com/security/CVE-2026-7381 · Vendor Advisory
• https://twitter.com/lyrie_ai/status/2056216021145366946 · Twitter Post
• https://twitter.com/lyrie_ai/status/2056216022131126774 · Twitter Post
• https://twitter.com/CVEnew/status/2049623719962632701 · Twitter Post
• https://twitter.com/lyrie_ai/status/2056216020306612284 · Twitter Post
• https://t.me/cveNotify/162475 · Telegram Post
• https://lists.security.metacpan.org/cve-announce/msg/39467666 · Note
• https://metacpan.org/release/MIYAGAWA/Plack-1.0053/changes · Note
• https://twitter.com/oss_security/status/2049705514922107060 · Twitter Post