Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Plack removes trailing slash from file paths, exposing sensitive data

CVE-2014-5269 · published 12 years ago
Summary

A security issue in Plack's file handling allows attackers to access sensitive information. This affects Plack versions before 1.0031. To protect your system, update Plack to the latest version.

What to do
  • Update debian libplack-perl to version 1.0031-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian libplack-perl < 1.0031-1
Fix: upgrade to 1.0031-1
Debian:12 debian libplack-perl < 1.0031-1
Fix: upgrade to 1.0031-1
Debian:13 debian libplack-perl < 1.0031-1
Fix: upgrade to 1.0031-1
Debian:14 debian libplack-perl < 1.0031-1
Fix: upgrade to 1.0031-1
– plack_project plack <= 1.0030
cpe:2.3:a:plack_project:plack:*:*:*:*:*:*:*:*
Original advisory text
Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a...
Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static.
References
Severity
5.0 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published4 Sep 2014
Updated29 Oct 2026
First seen8 Aug 2026
Sources
DEBIAN-CVE-2014-5269 · OSV
CVE-2014-5269 · NVD
Track software like this
Free during beta