CVE-2026-93712
Received Received - Intake

Path Traversal in Dancer2 Perl Framework

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CPANSec

Description
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. The handler joins the request path onto public_dir without collapsing relative segments, and checks only that the result is a readable regular file. A request for `/../outside.txt` escapes public_dir, and percent-encoding the dots reaches the same file. The handler is off by default. An application is affected once it names File in route_handlers and sets static_handler to 0, which otherwise refuses a dot segment before the route runs. Any file the worker process can read is served to an unauthenticated request, including the application's config.yml above public_dir.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-93712
EUVD
EUVD-2026-84258

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
perl_dancer dancer2 From 2.1.0 (inc) to 2.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-93712 is a path traversal vulnerability in Dancer2, a Perl web framework. It allows attackers to access files outside the intended public directory by manipulating path segments with sequences like '../'. The vulnerability occurs because the File route handler joins the public directory path with the request path without verifying if the result stays within the public directory. This lets unauthenticated users request files such as '/etc/passwd' or application config files.

Detection Guidance

Check if your Dancer2 application uses the File route handler with static_handler set to 0. Inspect the application configuration for routes using File and verify if the handler joins paths without collapsing relative segments. Test for path traversal by sending requests with encoded or unencoded '../' sequences to files outside the public directory.

Impact Analysis

This vulnerability allows unauthenticated attackers to read any file the web server process can access, including sensitive system files or application configuration files. If your Dancer2 application uses the File route handler with static_handler disabled, attackers could exploit this to steal data, access credentials, or compromise the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (protected health information). Unauthorized file access may result in data breaches, leading to regulatory fines, legal penalties, and reputational damage for organizations handling regulated data.

Mitigation Strategies

Upgrade Dancer2 to version 2.2.0 or later to apply the patch. If upgrading is not possible, disable the File route handler or set static_handler to 1 in the configuration. Ensure the application does not serve sensitive files outside the public directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93712. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart