Plack::Middleware::XSendfile CVE-2026-7381

Requires Plack application deployed behind nginx reverse proxy with Plack::Middleware::XSendfile middleware enabled AND the variation setting not explicitly configured in the middleware constructor or PSGI environment variables. Exploitation is limited to nginx deployments specifically because the attack relies on nginx's X-Accel-Redirect internal redirect mechanism combined with X-Accel-Mapping path rewriting. Applications using Apache mod_xsendfile or lighttpd's X-Sendfile are not affected by this specific attack vector. The vulnerability does NOT affect applications that hardcode the sendfile type in middleware initialization, as this prevents client override via headers. Default Plack installations without explicitly adding XSendfile middleware are not vulnerable. Attack succeeds against any HTTP endpoint that triggers XSendfile middleware processing, requiring no authentication, no user interaction, and low attack complexity (CVSS: AV:N/AC:L/PR:N/UI:N). Attackers must know or guess target file paths on the server to exploit effectively, as the vulnerability enables file read but not directory traversal enumeration.

CVSS 9.1 (Critical) reflects severe technical impact with network-exploitable remote code execution potential requiring no authentication (AV:N/AC:L/PR:N/UI:N), allowing high confidentiality and integrity compromise with no availability impact (C:H/I:H/A:N). However, real-world risk is significantly lower than the CVSS suggests due to multiple limiting factors. EPSS score of 0.01% (0th percentile) indicates extremely low observed exploitation probability. The vulnerability requires a specific deployment architecture: Plack applications behind nginx reverse proxies with XSendfile middleware installed AND the variation setting not explicitly configured in code. This is not a default configuration scenario. The attack achieves arbitrary file read (confidentiality breach) but requires knowledge of target file paths on the server, limiting practical exploitation. The middleware's deprecation in version 1.0053 suggests vendor recognition of the design flaw, though deprecation is not the same as a security fix. No CISA KEV listing and no public POC reduces immediate threat. The comparison to CVE-2025-61780 provides attackers a conceptual blueprint, increasing future exploitation risk. Priority should be moderate: patch or remove the middleware for nginx deployments, but this is not the widespread critical emergency the CVSS alone suggests.

An attacker identifies a Perl web application using Plack framework behind an nginx reverse proxy. They send an HTTP request with crafted headers: X-Sendfile-Type: X-Accel-Redirect and X-Accel-Mapping: /protected=/etc to force the middleware into nginx's internal redirect mode with custom path mapping. The application processes the request, and the middleware rewrites a file path like /protected/passwd to /etc/passwd. Nginx's X-Accel-Redirect mechanism then serves /etc/passwd contents directly to the attacker, bypassing application access controls. The attacker iterates through known sensitive file paths (/etc/shadow, application config files, database credentials) to exfiltrate server secrets. Comparison to CVE-2025-61780 provides attackers a documented proof-of-concept methodology adaptable to Plack environments.