PT-2026-65079 · Cpan · Plack::App::Prerender

CVE-2026-17552 · Published 2026-07-27 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Plack::App::Prerender versions prior to 0.3.0

Description An issue exists where the software can proxy requests to an arbitrary host due to unvalidated concatenation of the REQUEST URI in the call() function. When the rewrite base is a plain string and does not contain a path, the system fails to verify if the path starts with a forward slash. An attacker can exploit this by submitting a request target starting with an at-sign (@), which transforms the base into an RFC 3986 userinfo component. This allows the attacker to redirect the request to a different hostname, enabling access to internal or restricted hosts accessible only by the webserver.

Recommendations Update to version 0.3.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-17552

GHSA-6X4W-X68J-PPQQ

Affected Products

Plack::App::Prerender

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17552.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-17552 · Security Note
• https://github.com/robrwo/perl-Plack-App-Prerender/commit/2d793dd69e2b6f4e469618ee742bd8402677202d.patch · Patch
• https://osv.dev/vulnerability/CVE-2026-17552 · Vendor Advisory
• https://github.com/robrwo/perl-Plack-App-Prerender/security/advisories/GHSA-6x4w-x68j-ppqq · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/07/28/3 · Note
• https://github.com/robrwo/perl-Plack-App-Prerender · Note
• https://metacpan.org/release/RRWO/Plack-App-Prerender-v0.3.0/changes · Note
• https://cpan.org/modules · Note