CVE-2026-93712
UnknownSummary
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. The handler joins the request path onto public_dir without collapsing relative segments, allowing access to files outside the public directory. The handler is off by default, but an application is affected once it names File in route_handlers and sets static_handler to 0.
Risk Assessment
The risk is unauthorized reading of any file the worker process can read, including application config files, potentially leading to sensitive data exposure.
Recommendation
Update Dancer2 to version 2.2.0 or later and avoid enabling the File handler without proper path sanitization.
Other vulnerabilities in Dancer2
See all- CVE-2026-93711Unknown
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name, allowing injection of additional headers and response splitting. The application must derive the header name from request data.
- CVE-2026-93710Unknown
Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks. A handler that halts does not stop cleanup, leading to the refused route being executed. This can allow bypassing checks in a before hook.
- CVE-2026-93709Unknown
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or different capitalisation on a case-insensitive filesystem misses the guard.
- CVE-2026-13577High
Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. It silently falls back to a built-in rand-derived session id, which has low entropy and is easily guessed. Predictable session ids could allow an attacker to gain access to systems.
Original NVD description (English source)
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. The handler joins the request path onto public_dir without collapsing relative segments, and checks only that the result is a readable regular file. A request for `/../outside.txt` escapes public_dir, and percent-encoding the dots reaches the same file. The handler is off by default. An application is affected once it names File in route_handlers and sets static_handler to 0, which otherwise refuses a dot segment before the route runs. Any file the worker process can read is served to an unauthenticated request, including the application's config.yml above public_dir.