Catalyst::Plugin::Static::Simple for Perl sets the Cache‑Control header to "public" for every static asset served. The implementation offers no means to override this header, including when the request contains an Authorization header. Consequently, intermediaries such as shared reverse proxies or CDN edge caches may store and later serve content that was intended to be private, thereby exposing sensitive data to unintended recipients.

All installations of Catalyst::Plugin::Static::Simple for Perl up to and including version 0.38 are affected. No further major versions are mentioned as affected in the advisory.

The CVSS score of 5.7 suggests moderate severity. The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog. This vulnerability means that any content served over HTTPS or HTTP to authenticated clients could be cached by a shared intermediary, potentially leaking data to other users. Exploitation requires the attacker to have access to a shared caching proxy or observe cached responses; thus the attack vector is information‑disclosure via caching, not an active attack.