Description
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Hex | plug | < 1.0.4 | 1.0.4 | GHSA-2q6v-32mr-8p8x |
| Hex | plug | >= 1.1.0, < 1.1.7 | 1.1.7 | GHSA-2q6v-32mr-8p8x |
| Hex | plug | >= 1.2.0, < 1.2.3 | 1.2.3 | GHSA-2q6v-32mr-8p8x |
| Hex | plug | >= 1.3.0, < 1.3.2 | 1.3.2 | GHSA-2q6v-32mr-8p8x |