CVE-2017-1000052

High

Published: 17/07/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions.

Risk Assessment

Organizations may be exposed to unauthorized access to files, potentially leading to data leaks or other security threats.

Recommendation

It is recommended to update Elixir Plug to the latest version to mitigate this vulnerability.

Other vulnerabilities in Elixir Plug

CVE-2017-1000053High
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.

Original NVD description (English source)

Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions.