EUVD-2026-63534
GHSA-cj6v-gcgr-8wgg
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
AC:H reflects shared-proxy prerequisite; PR:N because the attacker reads from cache unauthenticated; UI:R because victim must first make the authenticated request.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable.
The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.)
Configuring the expires time to "0" to disable caching, as documented, is ignored.
AnalysisAI
Catalyst::Plugin::Static::Simple through 0.38 unconditionally marks all static file responses as publicly cacheable via Cache-Control: public, including responses to requests bearing an Authorization header. This means shared HTTP proxies may cache authenticated responses and serve them to subsequent unauthenticated requestors. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) a shared HTTP caching proxy (CDN, reverse proxy, or enterprise proxy) must be positioned between the Catalyst application and both the victim and attacker; (2) an authenticated user (i.e., one whose request includes an Authorization header) must request the target static resource first, causing the proxy to cache it; (3) the cached static file must contain sensitive information worth retrieving. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N scores 5.7 (Medium), reflecting network accessibility and high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-supplied patch available at https://security.metacpan.org/patches/C/Catalyst-Plugin-Static-Simple/0.38/CVE-2026-15743-r1.patch, which corresponds to the upstream fix in GitHub PR #3 (https://github.com/perl-catalyst/Catalyst-Plugin-Static-Simple/pull/3). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today