/ 
Punk-0.16
/ Punk::Upload
Security Advisories (1)
CVE-2026-75870 (2026-08-22)

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key. An attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected.

NAME

Punk::Upload - an uploaded file from a multipart form

SYNOPSIS

post '/avatar' => sub {
    my ($c) = @_;
    my $up = $c->req->upload('avatar') or return $c->text('no file', 400);
    $up->save("/var/uploads/" . $up->filename);
    $c->json({ name => $up->filename, bytes => $up->size });
};

DESCRIPTION

A file part of a multipart/form-data request. $c->req->form parses the body once: ordinary fields become parameters ($c->param), and file parts become Punk::Upload objects reachable through $c->req->upload($name) (or $c->upload($name)) and $c->req->uploads. A field uploaded more than once yields an arrayref from uploads; upload gives the first.

The bytes are held in memory in this cut - bound your request body size accordingly; a tempfile-backed mode for large uploads is a follow-on.

METHODS

filename

The client-supplied file name (do not trust it as a path).

name

The form field name.

type

The part's Content-Type (application/octet-stream if the client sent none).

size

The byte length.

content

The uploaded bytes.

save($path)

Write the bytes to $path. Croaks if it cannot open the file.

SEE ALSO

Punk, "upload" in Punk::Request.

AUTHOR

LNATION <email@lnation.org>

LICENSE AND COPYRIGHT

This software is Copyright (c) 2026 by LNATION <email@lnation.org>.

This is free software, licensed under:

The Artistic License 2.0 (GPL Compatible)