CVE-2017-1000052

HIGH 7.8CVE-2017-1000052 · Published 17/07/2017 · updated 17/06/2026

In short

CVE-2017-1000052 is a HIGH (CVSS 7.8) vulnerability affecting plug (plug project).
Chance of exploitation in the next 30 days (EPSS): 0.42%, higher than 36.8% of all vulnerabilities.
Fix: update to 1.0.4, 1.1.7, 1.2.3, 1.3.2 or later.

Package	Affected versions	Patched versions
plug plug_project	`≥ 1.0.0, < 1.0.4≥ 1.1.0, < 1.1.7≥ 1.2.0, < 1.2.3≥ 1.3.0, < 1.3.2`	`1.0.41.1.71.2.31.3.2`

Description

Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions.

References

elixirforum.com/t/security-releases-for-plug/3913 · Third Party Advisory

More vulnerabilities in plug

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free