CVE-2017-1000052

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-07-17 · updated 2026-06-17
Weakness: CWE-74

Description

Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions.

Affected products

Plug Project Plug: from 1.0.0 before 1.0.4; from 1.1.0 before 1.1.7; from 1.2.0 before 1.2.3; from 1.3.0 before 1.3.2 — fixed in 1.0.4, 1.1.7, 1.2.3, 1.3.2

How to fix

Upgrade to a fixed version: Plug Project Plug 1.0.4, 1.1.7, 1.2.3, 1.3.2. Check the vendor advisory for mitigations.

References

https://elixirforum.com/t/security-releases-for-plug/3913
https://elixirforum.com/t/security-releases-for-plug/3913

Get alerted when CVE-2017-1000052 or the next vulnerability affects your stack