{"id":"CVE-2026-93712","published":"2026-09-22T01:16:55.957","lastModified":"2026-09-22T20:17:12.580","description":"Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler.\n\nThe handler joins the request path onto public_dir without collapsing relative segments, and checks only that the result is a readable regular file. A request for `/../outside.txt` escapes public_dir, and percent-encoding the dots reaches the same file.\n\nThe handler is off by default. An application is affected once it names File in route_handlers and sets static_handler to 0, which otherwise refuses a dot segment before the route runs.\n\nAny file the worker process can read is served to an unauthenticated request, including the application's config.yml above public_dir.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/PerlDancer/Dancer2/commit/2446a09ffb83fef71cc75c327bd6e4b1f007b885.patch","tags":[]},{"url":"https://github.com/PerlDancer/Dancer2/security/advisories/GHSA-6xw8-v24c-m783","tags":[]},{"url":"https://metacpan.org/release/CROMEDOME/Dancer2-2.2.0/changes","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/22/4","tags":[]}],"exploitRefs":[{"url":"https://github.com/PerlDancer/Dancer2/commit/2446a09ffb83fef71cc75c327bd6e4b1f007b885.patch","tags":[]},{"url":"https://github.com/PerlDancer/Dancer2/security/advisories/GHSA-6xw8-v24c-m783","tags":[]}],"hasPoc":true,"ai":{"summary":"Dancer2 web framework allows directory traversal through File route handler that doesn't properly collapse relative path segments, enabling access to files outside the designated public directory. This affects applications using static_handler=0 and explicitly naming File in route_handlers.","exploitability":"Exploitation is straightforward for applications with File route handler enabled and static_handler=0, requiring only a single HTTP request with relative path traversal segments like '/../outside.txt' or encoded dots.","blast_radius":"Impact could be severe as attackers can read any file the web worker process can access, including sensitive configuration files like config.yml that may contain database credentials, API keys, and application secrets.","remediation":"Upgrade to Dancer2 version 2.2.0 or later to fix the directory traversal vulnerability in the File route handler.","detection":"Monitor for HTTP requests with path traversal patterns like '/../', '/./', or encoded dots (%2E%2E) in the URI path, particularly against endpoints using File route handler. Look for unusual file access patterns in web server logs or application logs that reference files outside the expected public directory structure.","tags":["directory-traversal","web","perl","config-exfiltration"],"model":"garnet-coder","analyzedAt":"2026-10-18T16:15:09.314Z"}}