CVE-2015-10149
Received Received - Intake

Session ID Injection in Perl Dancer Framework

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: CPANSec

Description
Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine. read_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session. A remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-15
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2015-10149
EUVD
EUVD-2015-9441

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
perldancer dancer to 1.3400 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1286 The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Perl Dancer web framework before version 1.3400. It involves improper handling of session IDs from cookies. The framework passes unvalidated session IDs directly to the session engine without checking their format. Attackers can exploit this by sending malicious session IDs, such as path traversal strings, to manipulate file-based session storage or execute unauthorized commands.

Detection Guidance

Check if your Dancer application uses session modules like Dancer::Session::JSON or Dancer::Session::Storable. Inspect session ID handling in logs or code for path traversal attempts like '../../../etc/passwd' in session IDs.

Impact Analysis

If you use a vulnerable version of Dancer, an attacker could craft a malicious session ID to access sensitive files on your server or execute arbitrary commands. This could lead to unauthorized data access, server compromise, or further attacks depending on the session engine used. Systems relying on file-based session storage are particularly at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. If exploited, it may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations. Compliance depends on implementing proper session ID validation and secure session handling.

Mitigation Strategies

Upgrade Dancer to version 1.3400 or later where session ID validation is enforced. Ensure file-based session engines validate session IDs before processing. Review session ID generation and storage logic for compliance with allowed character sets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2015-10149. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...