CVE-2026-93712: Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler.
The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request for /../outside.txt escapes publicdir, and percent-encoding the dots reaches the same file.
The handler is off by default. An application is affected once it names File in routehandlers and sets statichandler to 0, which otherwise refuses a dot segment before the route runs.
Any file the worker process can read is served to an unauthenticated request, including the application's config.yml above publicdir.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dancer2to a version that resolves this vulnerability.Fixed in 2.2.0 - Upgrade
Upgrade
Dancer2to a version that resolves this vulnerability.Fixed in 2.2.0Patch CVE-2026-93712
Event History
Frequently Asked Questions
Which deployments are affected?
The vulnerable File route handler is off by default. An application is affected when it includes File in route_handlers and sets static_handler to 0; affected releases are Dancer2 2.1.0 through versions before 2.2.0.
What does an attacker need to exploit this issue?
An attacker only needs to send an unauthenticated HTTP request to a reachable affected application. They can use relative path segments, including percent-encoded dots, to request files outside public_dir.
What data could be exposed?
Any regular file readable by the worker process may be served. This can include files such as the application's config.yml located above public_dir.
How can I determine whether an application is exposed?
Review the application's configuration for File in route_handlers together with static_handler set to 0. On an affected version, requests containing traversal segments such as /../outside.txt may be handled as files outside public_dir if the target is readable by the worker process.