{"id":"CVE-2014-5269","aliases":["DEBIAN-CVE-2014-5269","DLA-61-1","EUVD-2014-5162","GHSA-vx87-xj55-ccgc","MGASA-2014-0486"],"status":"published","title":"Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which...","description":"Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02455,"percentile":0.84504,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2014-09-04T17:00:00Z","modified":"2026-10-23T15:47:24Z","fixes":[{"ecosystem":"Debian:12","package":"libplack-perl","fixed_in":["1.0031-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libplack-perl","fixed_in":["1.0031-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libplack-perl","fixed_in":["1.0031-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"libplack-perl","fixed_in":["0.9941-1+deb6u1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"perl-Plack","fixed_in":["1.1.400-2.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"perl-Plack","fixed_in":["1.2.900-2.1.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libplack-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0031-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libplack-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0031-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libplack-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0031-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"libplack-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9941-1+deb6u1"}]}],"versions":["0.9941-1"]},{"source":"osv","ecosystem":"Mageia:3","package":"perl-Plack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.400-2.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"perl-Plack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.900-2.1.mga4"}]}]}],"products":[{"vendor":"plack_project","product":"plack"}],"references":[{"url":"http://seclists.org/oss-sec/2014/q3/384","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137099.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://github.com/avar/Plack/commit/bc1731dbb53850c380875ad683cd87c8ec99eee3","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.osvdb.org/109928","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"https://github.com/plack/Plack/issues/405","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://api.metacpan.org/source/MIYAGAWA/Plack-1.0031/Changes","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137115.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5269"},{"url":"https://github.com/advisories/GHSA-vx87-xj55-ccgc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-5269","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0486.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14012","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-August/137115.html","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-5269","description":"Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static.","status":"published","published":"2014-09-04T17:00:00Z","modified":"2024-08-06T11:41:48.023Z","updated_at":"2026-11-02T14:33:41.889751Z"}],"euvd":[{"id":"EUVD-2014-5162","description":"Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static.","status":"published","published":"2014-09-04T17:00:00Z","modified":"2024-08-06T11:41:48Z","updated_at":"2026-11-03T01:57:03.789124Z"}],"ghsa":[{"id":"GHSA-vx87-xj55-ccgc","title":"Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which...","description":"Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static.","status":"published","published":"2022-05-17T04:37:34Z","modified":"2023-01-28T05:02:18Z","updated_at":"2026-11-02T14:43:45.385Z"}],"nvd":[{"id":"CVE-2014-5269","description":"Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static.","status":"published","published":"2014-09-04T17:55:06.06Z","modified":"2026-06-17T00:11:18.497Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:55.540337Z"}],"osv":[{"id":"CVE-2014-5269","description":"Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static.","status":"published","published":"2014-09-04T17:55:06Z","modified":"2026-04-16T06:24:20.363465207Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-5269","description":"Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static.","status":"published","published":"2014-09-04T17:55:06.06Z","modified":"2026-10-23T15:47:24.157954168Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DLA-61-1","title":"libplack-perl - security update","status":"published","published":"2014-09-24T00:00:00Z","modified":"2026-03-09T02:10:45.021121Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2014-0486","title":"Updated perl-Plack package fixes security vulnerability","description":"Plack::App::File would previously strip trailing slashes off provided paths.\nThis in combination with the common pattern of serving files with\nPlack::Middleware::Static could allow an attacker to bypass a whitelist of\ngenerated files (CVE-2014-5269).\n","status":"published","published":"2014-11-26T10:14:01Z","modified":"2026-04-16T06:23:16.799510847Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}