CVE-2026-7381

The middleware does not require the sendfile mechanism type (variation setting) to be established in the constructor or Plack environment — the client can control it by sending the HTTP X-Sendfile-Type header. The attacker sets this header to the value "X-Accel-Redirect" and then uses the X-Accel-Mapping header to define path mapping, pointing to any file on the server. As a result, nginx serves the file indicated by the attacker instead of the one approved by the application. The vulnerability is similar to CVE-2025-61780 concerning Rack::Sendfile, although Plack::Middleware::XSendfile does not allow regular expressions in mapping and limits the attack exclusively to X-Accel-Redirect mode.

An attacker without any privileges can gain access to arbitrary files on the server (e.g., configuration files, private keys, user data), leading to critical breach of confidentiality and integrity of stored information.

Immediate discontinuation of Plack::Middleware::XSendfile use is required — since version 1.0053 the module is marked as deprecated and will be removed in future Plack releases. Apply patches available from the vendor according to the references and verify the middleware configuration for explicit sendfile type setting in the constructor or Plack environment, rather than leaving this decision to the client.

Plack::Middleware::XSendfile in versions up to and including 1.0053 for Perl language, used in services running behind an nginx reverse proxy.