CVE-2026-93709
Received Received - Intake

Dancer2 AutoPage Layout Disclosure via Path Manipulation

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CPANSec

Description
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or a different capitalisation on a case-insensitive filesystem therefore misses the guard. The handler is off by default, enabled with auto_page. The layout wrapping every page is already public, so this discloses one of the application's other layouts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-93709
EUVD
EUVD-2026-84255

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
perldancer dancer2 to 2.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-41 The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Dancer2 versions before 2.2.0 allows a layout template to be served as a regular page due to a case-sensitivity bypass on filesystems like macOS APFS or Windows NTFS. The AutoPage handler checks request paths against layout directories but fails to account for case differences, allowing requests like /Layouts/main to incorrectly render layout files as pages.

Detection Guidance

To detect this vulnerability, check if your Dancer2 application is running with the auto_page handler enabled. Inspect the application's configuration for any case-insensitive filesystem paths that might allow bypassing the layout guard. Test by sending requests with varied capitalization in paths to see if layout templates are incorrectly served as pages.

Impact Analysis

This vulnerability could expose sensitive layout templates as public pages, potentially leaking application structure, internal paths, or other confidential data. Attackers might access these templates by manipulating path case, bypassing intended access controls.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by exposing internal application layouts as public pages. If layout templates contain sensitive data or references to other resources, unauthorized access may lead to information disclosure. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. Unauthorized access to layouts could violate these requirements.

Mitigation Strategies

Upgrade Dancer2 to version 2.2.0 or later to apply the fix. If upgrading is not immediately possible, disable the auto_page handler in your application's configuration to prevent the vulnerable behavior. Review filesystem permissions to ensure layout templates are not accessible as regular pages.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93709. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart