What is the CVSS score of CVE-2026-7381?

CVE-2026-7381 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Plack::Middleware::XSendfile are affected by CVE-2026-7381?

CVE-2026-7381 affects Plack::Middleware::XSendfile and allows unauthenticated remote attackers to read arbitrary files from nginx-proxied servers through header injection attacks.

How to fix or mitigate CVE-2026-7381?

Within 24 hours: Inventory all Plack applications and identify those using Plack::Middleware::XSendfile (check Gemfile, Gemfile.lock, or package manifests for versions ≤1.0053). Within 7 days: Remove or disable Plack::Middleware::XSendfile from all applications; migrate to native nginx sendfile functionality or alternative file serving mechanisms without this middleware. Implement request header validation to reject malformed X-Sendfile-Type and X-Accel-Mapping headers at the nginx proxy layer. Within 30 days: Complete deprecation by removing the middleware entirely and validate that file access controls function correctly through alternative methods; conduct log analysis for evidence of exploitation attempts.

Plack::Middleware::XSendfile CVE-2026-7381

CRITICAL

Information Exposure (CWE-200)

2026-04-29 CPANSec

Information Disclosure Nginx

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 30, 2026 - 14:22 vuln.today

CVSS changed

Apr 30, 2026 - 14:22 NVD

9.1 (CRITICAL)

Analysis Generated

Apr 29, 2026 - 23:00 vuln.today

CVE Published

Apr 29, 2026 - 22:13 nvd

CRITICAL 9.1

DescriptionCVE.org

Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting.

Plack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment.

A malicious client can set the X-Sendfile-Type header to "X-Accel-Redirect" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server.

Since 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack.

This is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the "X-Accel-Redirect" type.

AnalysisAI

Plack::Middleware::XSendfile through version 1.0053 allows remote unauthenticated attackers to read arbitrary files from nginx-proxied servers by injecting malicious X-Sendfile-Type and X-Accel-Mapping headers. When the middleware's sendfile type is not explicitly configured, clients can force nginx's X-Accel-Redirect mode and manipulate path mappings to access sensitive files outside intended directories. The middleware has been deprecated as of version 1.0053 and will be removed in future Plack releases. EPSS score of 0.01% suggests low current exploitation activity despite the high CVSS 9.1 rating. No public exploit code identified at time of analysis, though the attack technique mirrors the documented CVE-2025-61780 vulnerability in Rack::Sendfile.

Technical ContextAI

Plack::Middleware::XSendfile is a Perl middleware component that delegates static file serving to web servers (nginx, Apache, lighttpd) using X-Sendfile mechanisms for performance optimization. The vulnerability stems from CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) where the middleware accepts client-controlled X-Sendfile-Type headers to determine the file-serving mechanism. When deployed behind nginx reverse proxies, attackers can inject X-Sendfile-Type: X-Accel-Redirect combined with X-Accel-Mapping headers to rewrite file paths. Nginx's X-Accel-Redirect feature, designed for internal redirects to protected resources, becomes exploitable when path mappings are client-controlled. Unlike the related Rack::Sendfile CVE-2025-61780, Plack's implementation disallows regex patterns in mappings and restricts mapping application to X-Accel-Redirect type only, providing partial mitigation. The affected CPE (cpe:2.3:a:miyagawa:plack::middleware::xsendfile:*:*:*:*:*:*:*:*) identifies all versions through 1.0053.

RemediationAI

Remove Plack::Middleware::XSendfile from application middleware stacks entirely, as it is deprecated in version 1.0053 and scheduled for removal from future Plack releases per vendor advisory at https://metacpan.org/release/MIYAGAWA/Plack-1.0053/view/lib/Plack/Middleware/XSendfile.pm#DEPRECATION-NOTICE. If immediate removal is not feasible, implement the following compensating controls: explicitly set the variation parameter in the middleware constructor to a fixed value (e.g., 'X-Sendfile' for Apache or 'X-Lighttpd-Send-File' for lighttpd) to prevent client override via X-Sendfile-Type headers; validate and sanitize all file paths passed to XSendfile mechanisms using allowlists of permitted directories; configure nginx to reject or strip X-Sendfile-Type and X-Accel-Mapping headers from client requests at the reverse proxy layer (note this may break legitimate application functionality if these headers are expected). For nginx deployments specifically, restrict internal location blocks used with X-Accel-Redirect to only serve from explicitly defined safe directories, and audit nginx configuration for overly permissive internal directives. Migration path: replace XSendfile middleware with direct Plack::App::File or PSGI-native static file serving, accepting the performance trade-off, or implement application-level file serving with explicit path validation.