CVE-2026-13577

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. The handler joins the request path onto public_dir without collapsing relative segments, allowing access to files outside the public directory. The handler is off by default, but an application is affected once it names File in route_handlers and sets static_handler to 0.

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name, allowing injection of additional headers and response splitting. The application must derive the header name from request data.

Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks. A handler that halts does not stop cleanup, leading to the refused route being executed. This can allow bypassing checks in a before hook.

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or different capitalisation on a case-insensitive filesystem misses the guard.