CVE-2026-15743

MediumCVSS 5.7

Published: 20/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 21/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public" with no means of overriding it, causing proxies to store content in a shared cache and reuse it in responses to other users' requests, including those with an Authorization header. Setting the expires time to "0" to disable caching is ignored.

Risk Assessment

The risk is that sensitive data (e.g., authorization-protected content) may be stored in public caches and served to other users, potentially leading to information disclosure.

Recommendation

Upgrade Catalyst::Plugin::Static::Simple to a version newer than 0.38 if a fix is available, or implement other cache control mechanisms to prevent public caching of responses.

Other vulnerabilities in Catalyst::Plugin::Static::Simple

CVE-2017-16248High
The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character.

Original NVD description (English source)

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.) Configuring the expires time to "0" to disable caching, as documented, is ignored.