CVE-2026-7381

{
  "id": "CVE-2026-7381",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-04-29T23:16:19.897",
  "lastModified": "2026-10-26T20:10:00.160",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting.\n\nPlack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment.\n\nA malicious client can set the X-Sendfile-Type header to \"X-Accel-Redirect\" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server.\n\nSince 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack.\n\nThis is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the \"X-Accel-Redirect\" type."
    },
    {
      "lang": "es",
      "value": "Las versiones de Plack::Middleware::XSendfile hasta la 1.0053 para Perl pueden permitir la reescritura de rutas controlada por el cliente.\n\nPlack::Middleware::XSendfile permite que la configuración de variación (tipo de sendfile) sea establecida por el cliente a través del encabezado X-Sendfile-Type, si no se considera en el constructor del middleware o en el entorno de Plack.\n\nUn cliente malicioso puede establecer el encabezado X-Sendfile-Type en ’X-Accel-Redirect’ para servicios que se ejecutan detrás de proxies inversos de nginx, y luego establecer el X-Accel-Mapping para mapear la ruta a un archivo arbitrario en el servidor.\n\nDesde la 1.0053, Plack::Middleware::XSendfile está obsoleto y será eliminado de futuras versiones de Plack.\n\nEsto es similar a CVE-2025-61780 para Rack::Sendfile, aunque Plack::Middleware::XSendfile tiene algunas mitigaciones que no permiten que se utilicen expresiones regulares en el mapeo, y solo aplican el mapeo para el tipo ’X-Accel-Redirect’."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "MIYAGAWA",
          "product": "Plack::Middleware::XSendfile",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Plack",
          "programFiles": [
            "lib/Plack/Middleware::XSendfile.pm"
          ],
          "repo": "https://github.com/plack/Plack",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.0053",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-30T13:18:16.234435Z",
          "id": "CVE-2026-7381",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-441"
        },
        {
          "lang": "en",
          "value": "CWE-913"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:miyagawa:plack\\:\\:middleware\\:\\:xsendfile:*:*:*:*:*:perl:*:*",
              "versionEndIncluding": "1.0053",
              "matchCriteriaId": "29005B5E-82D5-4EB7-8387-D831C6963F11"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://metacpan.org/release/MIYAGAWA/Plack-1.0053/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://metacpan.org/release/MIYAGAWA/Plack-1.0053/view/lib/Plack/Middleware/XSendfile.pm#DEPRECATION-NOTICE",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61780",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "US Government Resource"
      ]
    }
  ]
}