CPANSA-Dancer2-2026-93712: Dancer2 vulnerability

Publisher giterlizzi Document category csaf_security_advisory
Initial release date 2026-09-22T00:00:00 Engine CSAF Perl Toolkit 0.26
Current release date 2026-09-22T00:00:00 Build Date
Current version 1 Status final
CVSS v3.1 Base Score 7.5 Severity High
Original language Language en
Also referred to

Vulnerability Description

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler.

The handler joins the request path onto public_dir without collapsing relative segments, and checks only that the result is a readable regular file. A request for `/../outside.txt` escapes public_dir, and percent-encoding the dots reaches the same file.

The handler is off by default. An application is affected once it names File in route_handlers and sets static_handler to 0, which otherwise refuses a dot segment before the route runs.

Any file the worker process can read is served to an unauthenticated request, including the application's config.yml above public_dir.

Vulnerabilities

CVE-2026-93712

Vulnerability Description

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler.

The handler joins the request path onto public_dir without collapsing relative segments, and checks only that the result is a readable regular file. A request for `/../outside.txt` escapes public_dir, and percent-encoding the dots reaches the same file.

The handler is off by default. An application is affected once it names File in route_handlers and sets static_handler to 0, which otherwise refuses a dot segment before the route runs.

Any file the worker process can read is served to an unauthenticated request, including the application's config.yml above public_dir.

Weakness CWE-22 : Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Known affected
Product Score
Dancer2 greater than or equal 2.1.0 and less than 2.2.0
CVSS Version CVSS Vector CVSS Base Score CVSS Base Severity
3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 7.5 High
Fixed

giterlizzi

Namespace: https://github.com/giterlizzi/

gdt@cpan.org

References

Revision history

Version Date of the revision Summary of the revision
1 Tue Sep 22 00:00:00 2026 First release

Sharing rules

TLP:WHITE
For the TLP version see: https://www.first.org/tlp/