CVE-2026-7381 - Vulnerability Analysis

Overview

Plack::Middleware::XSendfile <= 1.0053 for Perl contains a path traversal caused by client-controlled X-Sendfile-Type and X-Accel-Mapping headers, letting remote attackers access arbitrary files via nginx reverse proxy, exploit requires crafted headers.

Severity & Score

Impact

Remote attackers can read arbitrary files on the server via nginx reverse proxy, potentially exposing sensitive information.

Mitigation

Update to a version after 1.0053 or remove usage as it is deprecated.

References

• https://metacpan.org/release/MIYAGAWA/Plack-1.0053/changes
• https://metacpan.org/release/MIYAGAWA/Plack-1.0053/view/lib/Plack/Middleware/XSendfile.pm#DEPRECATION-NOTICE
• https://nvd.nist.gov/vuln/detail/CVE-2025-61780

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner