Remote File Disclosure in Catalyst-Plugin-Static-Simple for Perl

CVE-2017-16248

What is CVE-2017-16248?

The Catalyst-Plugin-Static-Simple module prior to version 0.34 for Perl is susceptible to a vulnerability that allows remote attackers to read arbitrary files on the server. This occurs when a '.' character is present anywhere in the pathname, contravening the intended access policy which permits file reading only if the filename itself contains a '.'. This flaw poses significant risks, enabling unauthorized access to sensitive information.

References