CVE-2015-10149: Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine

Q: What does an attacker need to exploit this issue?

A remote attacker needs to be able to send a crafted session cookie value. Exploitation additionally depends on the configured session engine using that value in a file path, cache command, or query without performing its own validation.

Q: Are all Dancer session configurations equally exposed?

No. Dancer passes the unvalidated cookie value to the session engine, but the practical impact is conditional on the session engine using the session ID unsafely in a path, command, or query. The provided information does not identify which session engines perform that validation.

Q: How can I determine whether an application is affected?

Check whether it uses a Dancer version before 1.3400. Then review the active session engine to determine whether it uses session IDs in file paths, cache commands, or queries without validating their characters.

Published Nov 14, 2026

Updated

Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine.

readsessionid returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session.

A remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it.

Affected Software

4 affected componentsFixes available

debian/libdancer-perl<1.3400+dfsg-1

1.3400+dfsg-1

debian/libdancer-perl<1.3400+dfsg-1

1.3400+dfsg-1

debian/libdancer-perl<1.3400+dfsg-1

1.3400+dfsg-1

debian/libdancer-perl

1.3521+dfsg-11.3522-2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/libdancer-perl to a version that resolves this vulnerability.
Fixed in 1.3400+dfsg-1
Upgrade
Upgrade debian/libdancer-perl to a version that resolves this vulnerability.
Fixed in 1.3521+dfsg-1Fixed in 1.3522-2
Upgrade
Upgrade Dancer for Perl to a version that resolves this vulnerability.
Fixed in 1.3400

Event History

Nov 14, 2026

CVE Published

via MITRE·08:10 PM

Data Sourced

via MITRE·08:10 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·08:17 PM

DescriptionWeakness

Data Sourced

via OSV·09:47 PM

DescriptionAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

A remote attacker needs to be able to send a crafted session cookie value. Exploitation additionally depends on the configured session engine using that value in a file path, cache command, or query without performing its own validation.

Are all Dancer session configurations equally exposed?

No. Dancer passes the unvalidated cookie value to the session engine, but the practical impact is conditional on the session engine using the session ID unsafely in a path, command, or query. The provided information does not identify which session engines perform that validation.

How can I determine whether an application is affected?

Check whether it uses a Dancer version before 1.3400. Then review the active session engine to determine whether it uses session IDs in file paths, cache commands, or queries without validating their characters.

CVE-2015-10149: Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Are all Dancer session configurations equally exposed?

How can I determine whether an application is affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Are all Dancer session configurations equally exposed?

How can I determine whether an application is affected?