Plack::Middleware::ETag versions 0.04 through the versions that precede 0.06 contain a flaw that causes the default ETag header to include the file's inode number, modification time, and size when the response body is a filehandle and the file_etag option is not set. This accidental disclosure leaks a unique identifier for each file that can be used by clients or attackers to correlate files served under different URLs or to fingerprint the underlying filesystem. Although the vulnerability does not allow direct code execution or modify data, it exposes potentially sensitive internal information that could aid in further attacks.

Systems running the Plack::Middleware::ETag Perl module with an installed version 0.04 or any release prior to 0.06 are affected. The vulnerability resides in the default ETag construction logic when the file_etag configuration is unset or set to include 'inode'. Any Perl application that employs the middleware in this configuration is susceptible, regardless of the surrounding web framework or deployment environment.

The flaw is a low-effort information‑leak risk; an attacker only needs to provoke the middleware to generate an ETag, which occurs on ordinary file responses. No authentication or privileged access is required beyond the ability to send HTTP requests to the application. Because the EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, the exact exploit probability is unknown, but the potential impact on confidentiality and correlation capabilities warrants prompt remediation.