Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-7381 is a critical-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Miyagawa Plack\. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Token Impersonation/Theft (T1134.001); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-16 (Security and Privacy Attributes) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-7381 affects Plack::Middleware::XSendfile versions through 1.0053 for Perl, enabling client-controlled path rewriting. The middleware allows the sendfile type variation to be set by clients via the X-Sendfile-Type header if it is not configured in the middleware constructor or Plack environment. This vulnerability is associated with CWE-200 (Exposure of Sensitive Information), CWE-441 (Unintended Proxy or Intermediary), and CWE-913 (Improper Control of Dynamically-Identified Variables), earning a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Remote unauthenticated attackers can exploit this by setting the X-Sendfile-Type header to "X-Accel-Redirect" in services behind nginx reverse proxies, then using the X-Accel-Mapping header to redirect paths to arbitrary files on the server, potentially disclosing or manipulating sensitive data.
Advisories note that Plack::Middleware::XSendfile has been deprecated since version 1.0053 and will be removed from future Plack releases. It includes mitigations disallowing regular expressions in mappings and restricting mappings to the "X-Accel-Redirect" type only. Relevant references include the Plack 1.0053 changes and deprecation notice on MetaCPAN, as well as NVD details for the similar CVE-2025-61780 in Rack::Sendfile.
This vulnerability shares mechanics with CVE-2025-61780 but incorporates the noted mitigations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26296
Vulnerability Data
Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack…
more
environment. A malicious client can set the X-Sendfile-Type header to "X-Accel-Redirect" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server. Since 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack. This is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the "X-Accel-Redirect" type.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 7 hardening rules · 5 OS baselines
V10.4.9V11.7.1V14.1.2V14.2.4
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement directly stops unauthorized actors from obtaining sensitive information.
Information flow enforcement structurally prevents sensitive data from reaching unauthorized recipients.
Protection of information at rest prevents unauthorized exposure of stored sensitive data.
Transmission confidentiality mechanisms stop exposure of sensitive data on the wire.
Associating and preserving security attributes such as original source identity prevents the loss of provenance that creates the confused deputy.
Least privilege reduces the set of actors who can reach sensitive information.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.AA-05 directly enforces least-privilege authorization that blocks most unauthorized disclosures, yet CWE-200 also arises from logging, error messages, and side-channel paths that access controls alone do not address.
PR.DS-10 mostly prevents CWE-200 by directly eliminating unauthorized access to sensitive data-in-use, yet only partially addresses the weakness because CWE-200 spans many other exposure vectors outside runtime protection.
PR.IR-01's segmentation/zero-trust controls largely eliminate network-level unauthorized access paths that enable exposure, yet CWE-200 spans many additional vectors (API responses, logs, app logic) that network controls alone cannot close.
Secure SDLC practices catch most exposure flaws via design, testing and release controls, yet CWE-200 spans runtime/config issues a single development outcome cannot fully close.
Runtime-environment monitoring can detect exploitation of the weakness but does not prevent it.
Vulnerability identification can surface instances of CWE-913 but does not mitigate the root weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Clear rules on handling copies, storage, and disposal of classified information lower the likelihood that sensitive data will be left accessible to unauthorized actors.
Requiring the return of all physical and electronic assets plus secure deletion of organizational data from personal devices reduces the chance that sensitive information remains accessible to departing personnel.
By requiring owners to assign sensitivity labels and corresponding handling rules, the control ensures that information is not left unmarked and therefore reduces the chance that sensitive data will be exposed to unauthorized actors.
By requiring classification labels and metadata on all information assets, the control makes it harder for sensitive data to be inadvertently exposed because downstream systems and users can recognize and enforce handling rules based on those labels.
Requiring encryption, access controls, and recipient authentication for transfers directly reduces the chance that sensitive data reaches an unauthorized observer.
Access-control rules can limit which upstream identities may cause the product to act on their behalf, reducing confused-deputy risk.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Ubuntu 22.04 (1 rule)
- V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. prevents CWE-200
Ubuntu 24.04 (2 rules)
- V-270647 Ubuntu 24.04 LTS must not have the telnet package installed. prevents CWE-200
- V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. prevents CWE-200
Windows 10 (2 rules)
- V-220726 Data Execution Prevention (DEP) must be configured to at least OptOut. prevents CWE-913
- V-220737 Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. prevents CWE-200
Windows Server 2016 (1 rule)
- V-224974 Domain-created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-200
Windows Server 2019 (1 rule)
- V-205743 Windows Server 2019 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-200