GHSA-2q6v-32mr-8p8x CVE-2017-1000052
Null Byte Injection in Plug.Static
- Severity
- 7.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.42%
- Chance of exploitation in the next 30 days. Higher than 36.65% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- Fix
1.0.4- Upgrade plug to this version or later
Description
Plug.Static is used for serving static assets, and is vulnerable to null byte injection. If file upload functionality is provided, this can allow users to bypass filetype restrictions. We recommend all applications that provide file upload functionality and serve those uploaded files locally with Plug.Static to upgrade immediately or include the fix below. If uploaded files are rather stored and served from S3 or any other cloud storage, you are not affected.
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| plug | < 1.0.4 |
1.0.4 |
| plug | >= 1.1.0, < 1.1.7 |
1.1.7 |
| plug | >= 1.2.0, < 1.2.3 |
1.2.3 |
| plug | >= 1.3.0, < 1.3.2 |
1.3.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
plug Hex → 1.0.4
- mix
{:plug, "~> 1.0.4"} # then: mix deps.update plug
Severity breakdown
CVSS 3.1 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
How to prevent it
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-105963 Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments | Not rated yet | Also affects plug |
| EEF-CVE-2026-56813 Cookie attribute injection in Plug.Conn.Cookies.encode/2 | Not rated yet | Also affects plug |
| EEF-CVE-2026-56814 Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service) | Not rated yet | Also affects plug |
| EEF-CVE-2026-54892 Plug: quadratic-time decoding of nested query/body parameters enables denial of service | High | Also affects plug |
| EEF-CVE-2026-8468 Unbounded buffer accumulation in multipart header parsing causes denial of service in plug | High | Also affects plug |
| GHSA-9h73-w7ch-rh73 Header Injection | Medium | Also affects plug |
| GHSA-5v4m-c73v-c7gq Arbitrary Code Execution in Cookie Serialization | High | Also affects plug |
| GHSA-j8rh-479h-cp32 Axios: Header Injection via Inherited headers After Minimal Interceptor | Medium | Same weakness, CWE-74 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor