Threats affecting pkg:github/Plack

CVE-2026-7381 is a critical vulnerability in Plack::Middleware::XSendfile for Perl that allows client-controlled path rewriting via the X-Sendfile-Type header. A malicious client can exploit this by setting the header to "X-Accel-Redirect" and manipulating the X-Accel-Mapping to access arbitrary files on the server behind nginx reverse proxies. This vulnerability exposes sensitive information to unauthorized actors. Plack::Middleware::XSendfile has been deprecated since version 1.0053 and will be removed in future releases. There is no official patch or remediation currently available.