CVE-2017-16248: Catalyst-Plugin-Static-Simple Project Catalyst-Plugin-Static-Simple

High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days.

The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character.

Affected products

• Catalyst-Plugin-Static-Simple Project Catalyst-Plugin-Static-Simple: before 0.34 (fixed in 0.34)

Published 2017-11-01. Last modified 2026-06-17.