Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler.

The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request for /../outside.txt escapes publicdir, and percent-encoding the dots reaches the same file.

The handler is off by default. An application is affected once it names File in routehandlers and sets statichandler to 0, which otherwise refuses a dot segment before the route runs.

Any file the worker process can read is served to an unauthenticated request, including the application's config.yml above publicdir.