CVE-2026-93709: Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler.
The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or a different capitalisation on a case-insensitive filesystem therefore misses the guard.
The handler is off by default, enabled with autopage. The layout wrapping every page is already public, so this discloses one of the application's other layouts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dancer2 (Perl)to a version that resolves this vulnerability.Fixed in 2.2.0
Event History
Frequently Asked Questions
Is a default Dancer2 deployment affected?
No. The vulnerable AutoPage handler is off by default and is enabled with the auto_page setting. Only deployments using Dancer2 before 2.2.0 with that handler enabled are exposed.
What does an attacker need to do to access a layout?
An attacker needs to request an alternative spelling of a layout path that bypasses the textual directory check but resolves to the layout during lookup. Examples include doubled slashes, dot segments, a percent-encoded slash, or different capitalization on a case-insensitive filesystem.
What information can be disclosed?
The issue can expose one of the application's other layouts as a page. The layout wrapping each page is already public, so the disclosed content is limited to another layout rather than the currently used wrapping layout.
What can be done if an upgrade is not immediately possible?
Disable the AutoPage handler by ensuring auto_page is not enabled. This removes the affected request handling path.