Plack::Middleware::XSendfile versions through 1.0053 for Perl allow a client to control path rewriting via the X-Sendfile-Type header. This enables an attacker to set the header to "X-Accel-Redirect" and manipulate the X-Accel-Mapping to access arbitrary files on the server. The middleware has some mitigations limiting regex use in mappings and only applies them for the "X-Accel-Redirect" type. Since version 1.0053, this middleware is deprecated and will be removed in future Plack releases.