Nixpkgs security tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: perl5Packages.Plack

Found 1 matching suggestions

View:
Compact
Detailed
Published
Permalink CVE-2026-7381
updated 4 hours ago by @LeSuisse Activity log
  • Created suggestion 9 hours ago
  • @LeSuisse ignored
    52 packages
    • perlPackages.TaskPlack
    • perl5Packages.TaskPlack
    • perl538Packages.TaskPlack
    • perl540Packages.TaskPlack
    • perlPackages.PlackAppProxy
    • perl5Packages.PlackAppProxy
    • perl538Packages.PlackAppProxy
    • perl540Packages.PlackAppProxy
    • perlPackages.PlackMiddlewareDebug
    • perl5Packages.PlackMiddlewareDebug
    • perlPackages.PlackMiddlewareHeader
    • perl5Packages.PlackMiddlewareHeader
    • perlPackages.PlackMiddlewareSession
    • perl538Packages.PlackMiddlewareDebug
    • perl540Packages.PlackMiddlewareDebug
    • perl5Packages.PlackMiddlewareSession
    • perlPackages.PlackMiddlewareDeflater
    • perlPackages.PlackTestExternalServer
    • perl538Packages.PlackMiddlewareHeader
    • perl540Packages.PlackMiddlewareHeader
    • perl5Packages.PlackMiddlewareDeflater
    • perl5Packages.PlackTestExternalServer
    • perl538Packages.PlackMiddlewareSession
    • perl540Packages.PlackMiddlewareSession
    • perlPackages.PlackMiddlewareAuthDigest
    • perl538Packages.PlackMiddlewareDeflater
    • perl538Packages.PlackTestExternalServer
    • perl540Packages.PlackMiddlewareDeflater
    • perl540Packages.PlackTestExternalServer
    • perl5Packages.PlackMiddlewareAuthDigest
    • perlPackages.PlackMiddlewareReverseProxy
    • perl538Packages.PlackMiddlewareAuthDigest
    • perl540Packages.PlackMiddlewareAuthDigest
    • perl5Packages.PlackMiddlewareReverseProxy
    • perlPackages.PlackMiddlewareConsoleLogger
    • perl5Packages.PlackMiddlewareConsoleLogger
    • perlPackages.PlackMiddlewareMethodOverride
    • perl538Packages.PlackMiddlewareReverseProxy
    • perl540Packages.PlackMiddlewareReverseProxy
    • perl5Packages.PlackMiddlewareMethodOverride
    • perl538Packages.PlackMiddlewareConsoleLogger
    • perl540Packages.PlackMiddlewareConsoleLogger
    • perl538Packages.PlackMiddlewareMethodOverride
    • perl540Packages.PlackMiddlewareMethodOverride
    • perlPackages.PlackMiddlewareRemoveRedundantBody
    • perl5Packages.PlackMiddlewareRemoveRedundantBody
    • perl538Packages.PlackMiddlewareRemoveRedundantBody
    • perl540Packages.PlackMiddlewareRemoveRedundantBody
    • perlPackages.PlackMiddlewareFixMissingBodyInRedirect
    • perl5Packages.PlackMiddlewareFixMissingBodyInRedirect
    • perl538Packages.PlackMiddlewareFixMissingBodyInRedirect
    • perl540Packages.PlackMiddlewareFixMissingBodyInRedirect
    4 hours ago
  • @LeSuisse ignored reference https://n… 4 hours ago
  • @LeSuisse accepted 4 hours ago
  • @LeSuisse published on GitHub 4 hours ago
Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting

Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment. A malicious client can set the X-Sendfile-Type header to "X-Accel-Redirect" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server. Since 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack. This is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the "X-Accel-Redirect" type.

Affected products

Plack
  • =<1.0053

Matching in nixpkgs

Ignored packages (52)