Plack::Middleware::XSendfile permits the X‑Sendfile‑Type header to be defined by the client when the middleware is not configured to fix that value. A malicious request can therefore change the rewrite mechanism to use X‑Accel‑Redirect and supply an X‑Accel‑Mapping header that points to any location on the server’s filesystem. The result is an arbitrary file read, which exposes confidential data without authentication. The flaw corresponds to CWE‑200, CWE‑441, and CWE‑913.

The issue affects any installation of the MIYAGAWA Plack::Middleware::XSendfile package up to and including version 1.0053 that is deployed within a Perl application. Systems that expose the middleware behind nginx reverse proxies are especially vulnerable if the reverse proxy does not strip client‑supplied X‑Sendfile‑Type and X‑Accel‑Mapping headers.

The vulnerability can be exploited via a normal HTTP request that includes forged X‑Sendfile‑Type and X‑Accel‑Mapping headers. The likely attack vector is a network request from an unauthenticated client. There are no special server conditions or privileged credentials required. The CVSS score is 9.1, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly documented large‑scale exploits so far. Nonetheless, the ability to read arbitrary files makes the risk high for confidentiality.