VYPR

Plack::App::Prerender

by Plack Project

CVEs (1)

  • CVE-2026-17552Jul 27, 2026
    risk 0.00cvss epss 0.00

    Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call. When the rewrite base is a plain string, the REQUEST_URI is appended to it, with no check that the path starts with a forward slash ('/'). …