PT-2026-65079

Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST URI concatenation in call. When the rewrite base is a plain string, the REQUEST URI is appended to it, with no check that the path starts with a forward slash '/'. When the rewrite base doe...