Executive brief
Catalyst::Plugin::Static::Simple is a Perl web framework module that serves static files to web applications. The module incorrectly marks all responses as publicly cacheable, allowing HTTP proxies and shared caches to store and reuse responses—including those protected by authentication headers—to other users. This can expose sensitive files meant only for authenticated users to unauthorized parties.
Technical details
The vulnerability is a cache control configuration bypass in the _serve_static method. The module unconditionally sets the Cache-Control header to "public", overriding HTTP caching semantics and signaling to intermediary proxies that responses may be stored in shared caches and reused. Additionally, the documented workaround of setting expires to "0" to disable caching is ignored, leaving no way for developers to prevent public caching of sensitive static files. An attacker or passive observer positioned on a network path with access to shared caches (common in CDNs, ISPs, and corporate proxies) can retrieve cached responses that were originally served only to authenticated users. No authentication or special network access is required beyond existing proxy positioning; the vulnerability is triggered automatically when responses are served.
Affected products
- Perl Catalyst::Plugin::Static::Simple through 0.38
Timeline
- 2026-08-20: disclosed
- other: CVE-2026-15743 assigned