{"id":"CVE-2026-7381","aliases":["DEBIAN-CVE-2026-7381","EUVD-2026-26296","GHSA-j2f5-52cv-9wrh","MGASA-2026-0350","UBUNTU-CVE-2026-7381"],"status":"published","title":"Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting","description":"Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting.\n\nPlack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment.\n\nA malicious client can set the X-Sendfile-Type header to \"X-Accel-Redirect\" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server.\n\nSince 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack.\n\nThis is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the \"X-Accel-Redirect\" type.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00442,"percentile":0.38726,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-441","CWE-913"],"published":"2026-04-29T22:13:35Z","modified":"2026-10-28T02:31:13Z","fixes":[{"ecosystem":"Mageia:10","package":"perl-Plack","fixed_in":["1.5.400-1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-Plack","fixed_in":["1.5.400-1.mga9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libplack-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0050-1","1.0051-1","1.0054-1","1.0055-1","1.0057-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libplack-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0051-1","1.0054-1","1.0055-1","1.0057-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libplack-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0051-1","1.0054-1","1.0055-1","1.0057-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Plack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.400-1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Plack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.400-1.mga9"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libplack-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0037-1","1.0038-1","1.0039-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libplack-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0042-1","1.0044-1","1.0045-1","1.0047-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libplack-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0047-1","1.0047-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libplack-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0048-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libplack-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0050-1","1.0051-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libplack-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0051-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libplack-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0051-1","1.0054-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libplack-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0051-1"]}],"products":[{"vendor":"miyagawa","product":"plack::middleware::xsendfile"},{"vendor":"miyagawa","product":"plack\\"}],"references":[{"url":"https://metacpan.org/release/MIYAGAWA/Plack-1.0053/changes","tags":["release-notes","Release Notes","advisory"]},{"url":"https://metacpan.org/release/MIYAGAWA/Plack-1.0053/view/lib/Plack/Middleware/XSendfile.pm#DEPRECATION-NOTICE","tags":["technical-description","Product","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61780","tags":["related","US Government Resource","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7381","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j2f5-52cv-9wrh"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7381.json","tags":["advisory"]},{"url":"https://github.com/plack/Plack","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-7381","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0350.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35449","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/29/27","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-7381","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7381","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/39467666/","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-7381","title":"Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting","description":"Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting.\n\nPlack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment.\n\nA malicious client can set the X-Sendfile-Type header to \"X-Accel-Redirect\" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server.\n\nSince 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack.\n\nThis is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the \"X-Accel-Redirect\" type.","status":"published","published":"2026-04-29T22:13:35.351Z","modified":"2026-04-30T13:18:45.937Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-200","CWE-441","CWE-913"],"updated_at":"2026-11-02T14:20:05.830416Z"}],"euvd":[{"id":"EUVD-2026-26296","description":"Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting.\n\nPlack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment.\n\nA malicious client can set the X-Sendfile-Type header to \"X-Accel-Redirect\" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server.\n\nSince 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack.\n\nThis is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the \"X-Accel-Redirect\" type.","status":"published","published":"2026-04-29T22:13:35Z","modified":"2026-04-30T13:18:45Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:05:19.116327Z"}],"ghsa":[{"id":"GHSA-j2f5-52cv-9wrh","title":"Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path...","description":"Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting.\n\nPlack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment.\n\nA malicious client can set the X-Sendfile-Type header to \"X-Accel-Redirect\" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server.\n\nSince 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack.\n\nThis is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the \"X-Accel-Redirect\" type.","status":"published","published":"2026-04-30T00:31:21Z","modified":"2026-04-30T15:31:40Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:07:52.236911Z"}],"nvd":[{"id":"CVE-2026-7381","description":"Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting.\n\nPlack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment.\n\nA malicious client can set the X-Sendfile-Type header to \"X-Accel-Redirect\" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server.\n\nSince 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack.\n\nThis is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the \"X-Accel-Redirect\" type.","status":"published","published":"2026-04-29T23:16:19.897Z","modified":"2026-10-26T20:10:00.16Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-200","CWE-441","CWE-913"],"updated_at":"2026-11-02T14:12:16.626888Z"}],"osv":[{"id":"CVE-2026-7381","title":"Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting","description":"Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting.\n\nPlack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment.\n\nA malicious client can set the X-Sendfile-Type header to \"X-Accel-Redirect\" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server.\n\nSince 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack.\n\nThis is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the \"X-Accel-Redirect\" type.","status":"published","published":"2026-04-29T22:13:35.351Z","modified":"2026-10-28T02:31:13.512691476Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-200","CWE-441","CWE-913"],"updated_at":"2026-11-02T15:45:16.365946Z"},{"id":"DEBIAN-CVE-2026-7381","description":"Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting.  Plack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment.  A malicious client can set the X-Sendfile-Type header to \"X-Accel-Redirect\" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server.  Since 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack.  This is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the \"X-Accel-Redirect\" type.","status":"published","published":"2026-04-29T23:16:19.897Z","modified":"2026-10-27T10:02:16.013840168Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:46:02.499355Z"},{"id":"UBUNTU-CVE-2026-7381","description":"Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment. A malicious client can set the X-Sendfile-Type header to \"X-Accel-Redirect\" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server. Since 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack. This is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the \"X-Accel-Redirect\" type.","status":"published","published":"2026-04-29T23:16:00Z","modified":"2026-10-17T13:01:04.007817513Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:57:08.628462Z"},{"id":"MGASA-2026-0350","title":"Updated perl-Plack packages fix a security vulnerability","description":"Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow\nclient-controlled path rewriting.\n","status":"published","published":"2026-08-31T19:40:26Z","modified":"2026-08-31T19:45:02.85270524Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}