Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111946— Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header

Quick assessment

Affected
CVE-2026-111946
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 语言中，Plack::Middleware::ETag 模块从 0.04 版本起至 0.06 版本之前的版本存在信息泄露漏洞：在默认生成的 ETag 响应头中会暴露文件的 inode 编号。 具体而言，当响应体为文件句柄且未设置 选项时，ETag 值将基于文件的 inode 编号、修改时间及文件大小生成。接收到受影响响应的客户端可利用所泄露的 inode 编号，辅助进行后端指纹识别，并关联通过不同 URL 提供的同一文件。

AI Predicted 3.3 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

I. Basic Information for CVE-2026-111946

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header
Source: CVE Program / CVE List V5
Vulnerability Description
Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected responses may use the disclosed inode numbers to aid backend fingerprinting and correlation of files served through different URLs.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
将系统数据暴露到未授权控制的范围
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0.04 ~ 0.06 -

II. Public POCs for CVE-2026-111946

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111946

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-111946 (1)

Other References for CVE-2026-111946 (1)

IV. Related Vulnerabilities

Same weakness: CWE-497

V. Comments for CVE-2026-111946

No comments yet

Leave a comment