CVE-2026-17552
Received Received - Intake

Server-Side Request Forgery in Plack::App::Prerender

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: CPANSec

Description
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call. When the rewrite base is a plain string, the REQUEST_URI is appended to it, with no check that the path starts with a forward slash ('/'). When the rewrite base does not contain a path (which is the standard given in the SYNOPSIS), an attacker can create a request that changes the hostname. A request target starting with an at-sign ('@') changes the base to a RFC 3986 userinfo component. For example, a rewrite base of "https://example.com" with the submitted request "GET @192.168.1.2/" will send a request to "https://[email protected]/", with the rendered content returned to the attacker. This allows an attacker to access internal or restricted hosts that only the webserver has access to.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-17552
EUVD
EUVD-2026-49394

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
plack app_prerender to 0.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Plack::App::Prerender versions before 0.3.0 for Perl. It allows an attacker to proxy requests to arbitrary hosts by manipulating the REQUEST_URI without proper validation. When the rewrite base is a plain string, the REQUEST_URI is appended without checking if it starts with a forward slash. An attacker can craft a request with an at-sign (@) to change the hostname, redirecting the request to internal or restricted hosts.

Detection Guidance

Check if your system uses Plack::App::Prerender versions before 0.3.0 by running: perl -MPlack::App::Prerender -e 'print $Plack::App::Prerender::VERSION'

Inspect web server logs for requests with unusual paths like @ followed by an IP address or hostname.

Use curl to test if the server is vulnerable: curl -v 'http://yourserver/@192.168.1.1/'

Impact Analysis

An attacker could exploit this to access internal or restricted hosts that the webserver can reach. This could lead to unauthorized access to sensitive data, internal services, or cloud metadata. The vulnerability acts as a Server-Side Request Forgery (SSRF), allowing external control over internal network requests.

Compliance Impact

This SSRF vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. It may result in unauthorized access to personal or sensitive data, leading to compliance breaches and potential legal consequences.

Mitigation Strategies

Upgrade Plack::App::Prerender to version 0.3.0 or later immediately.

If upgrading is not possible, apply the patch from the GitHub commit referenced in Resource 1.

Review and restrict access to internal services that the web server can reach.

Monitor network traffic for unusual outbound requests from the web server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17552. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart