CVE-2026-7381: Plack::Middleware Path Traversal Flaw

CVE-2026-7381 Overview

CVE-2026-7381 is an information disclosure vulnerability in Plack::Middleware::XSendfile versions through 1.0053 for Perl that allows client-controlled path rewriting. The vulnerability occurs when the middleware allows the sendfile type (variation setting) to be set by the client via the X-Sendfile-Type header when it is not explicitly configured in the middleware constructor or Plack environment.

A malicious client can exploit this flaw by setting the X-Sendfile-Type header to X-Accel-Redirect when targeting services running behind nginx reverse proxies, and then setting the X-Accel-Mapping header to map paths to arbitrary files on the server. This vulnerability is similar to CVE-2025-61780 affecting Rack::Sendfile, though Plack::Middleware::XSendfile includes some mitigations that disallow regular expressions in the mapping and only apply the mapping for the X-Accel-Redirect type.

Critical Impact
Attackers can potentially access arbitrary files on servers running Plack applications behind nginx reverse proxies by manipulating sendfile headers to control path rewriting behavior.

Affected Products

Plack::Middleware::XSendfile versions through 1.0053
Perl applications using the affected middleware
Services deployed behind nginx reverse proxies without explicit sendfile type configuration

Discovery Timeline

April 29, 2026 - CVE-2026-7381 published to NVD
April 29, 2026 - Last updated in NVD database

Technical Details for CVE-2026-7381

Vulnerability Analysis

The root of this vulnerability lies in improper input validation within Plack::Middleware::XSendfile. When the middleware is instantiated without explicitly setting the sendfile type (variation) in the constructor or through the Plack environment, it falls back to accepting the type from the client-supplied X-Sendfile-Type HTTP header. This design flaw allows untrusted client input to influence critical server-side path handling behavior.

When deployed behind an nginx reverse proxy, an attacker can leverage this by sending a request with X-Sendfile-Type: X-Accel-Redirect along with a crafted X-Accel-Mapping header. The mapping directive allows the attacker to remap file paths, potentially exposing sensitive files that should not be accessible to external clients.

The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), as successful exploitation can lead to unauthorized file access and information disclosure.

Root Cause

The vulnerability stems from the middleware trusting client-supplied header values when the sendfile variation is not explicitly configured. The X-Sendfile-Type header should only be controlled by the server-side configuration, but the lack of validation allows clients to override this setting. This trust boundary violation enables attackers to influence the file serving mechanism.

Attack Vector

The attack requires the target application to meet specific conditions: it must use Plack::Middleware::XSendfile without explicit sendfile type configuration and be deployed behind an nginx reverse proxy. The attacker sends specially crafted HTTP headers to manipulate the path mapping:

The attacker sets X-Sendfile-Type: X-Accel-Redirect to force the nginx-specific sendfile behavior
The attacker provides a malicious X-Accel-Mapping header to remap file paths
The middleware processes the attacker-controlled mapping and serves files from unintended locations

Unlike the related Rack::Sendfile vulnerability (CVE-2025-61780), Plack::Middleware::XSendfile has some built-in mitigations: it disallows regular expressions in the mapping configuration and only applies the mapping for the X-Accel-Redirect type. However, these mitigations do not fully prevent exploitation.

Detection Methods for CVE-2026-7381

Indicators of Compromise

Unusual HTTP requests containing X-Sendfile-Type headers from external clients
Requests with X-Accel-Mapping headers attempting to access sensitive file paths
Access log entries showing requests to paths that should not be externally accessible
Pattern matching for X-Sendfile-Type: X-Accel-Redirect in incoming request headers

Detection Strategies

Implement web application firewall (WAF) rules to flag or block requests containing X-Sendfile-Type or X-Accel-Mapping headers from external sources
Review nginx access logs for requests that may indicate path traversal or unauthorized file access attempts
Deploy intrusion detection signatures to identify exploitation patterns specific to sendfile header manipulation
Audit application code to identify instances of Plack::Middleware::XSendfile without explicit type configuration

Monitoring Recommendations

Enable detailed logging for requests containing sendfile-related headers to track potential exploitation attempts
Set up alerts for access to sensitive files through unexpected paths or methods
Monitor for anomalous patterns in file access that could indicate path rewriting exploitation

How to Mitigate CVE-2026-7381

Immediate Actions Required

Review all Plack applications for usage of Plack::Middleware::XSendfile and ensure explicit sendfile type configuration in the middleware constructor
Configure nginx to strip or ignore X-Sendfile-Type and X-Accel-Mapping headers from incoming client requests
Consider migrating away from the deprecated Plack::Middleware::XSendfile middleware as it will be removed from future Plack releases
Implement header sanitization at the reverse proxy layer to prevent client-controlled header injection

Patch Information

As of version 1.0053, Plack::Middleware::XSendfile has been marked as deprecated and will be removed from future releases of Plack. Organizations should plan to migrate to alternative file serving mechanisms. For detailed information about the changes and deprecation notice, refer to the MetaCPAN Release Changes and the MetaCPAN Deprecation Notice.

Workarounds

Explicitly set the sendfile variation parameter in the middleware constructor to prevent client header override
Configure nginx to remove untrusted sendfile headers before they reach the application using proxy_set_header X-Sendfile-Type ""; and proxy_set_header X-Accel-Mapping "";
Implement application-level validation to reject requests containing unexpected sendfile-related headers

bash

# nginx configuration to strip dangerous headers
location / {
    proxy_set_header X-Sendfile-Type "";
    proxy_set_header X-Accel-Mapping "";
    proxy_pass http://backend;
}