CVE-2026-93709 in Dancer2
Summary
by MITRE • 09/22/2026
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler.
The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or a different capitalisation on a case-insensitive filesystem therefore misses the guard.
The handler is off by default, enabled with auto_page. The layout wrapping every page is already public, so this discloses one of the application's other layouts.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
Dancer2 versions prior to 2.2.0 contain a path traversal vulnerability within its AutoPage handler that allows attackers to bypass access controls and disclose sensitive internal files. The core technical flaw stems from an inconsistency in how request paths are validated against the layout directory name. Specifically, the guard mechanism performs a direct text comparison between the incoming request path and the configured layout directory string. However, the subsequent file lookup operation canonicalizes the path before accessing it on the filesystem. This discrepancy creates a logic error where certain path manipulations can evade the initial check while still resolving to valid files within the protected directory structure during the actual read operation.
The vulnerability is exploitable through several specific techniques that exploit differences between string comparison and filesystem resolution. An attacker may utilize doubled slashes, such as double forward slashes in the URL path, which are often normalized by web servers or frameworks but not necessarily stripped before the text-based guard check. Additionally, dot segments like .. can be used to traverse up directory levels if the canonicalization process resolves them differently than the static string comparison expects. Percent-encoded characters, particularly percent-encoded slashes (%2F), may also bypass the textual filter while being decoded by the underlying file system lookup mechanism. Furthermore, on case-insensitive filesystems such as those found in Windows or macOS default configurations, variations in capitalization of directory names can circumvent the guard if it relies on exact case-sensitive string matching rather than normalized comparison.
The operational impact of this vulnerability is primarily information disclosure regarding the application's internal structure and assets. The AutoPage handler is disabled by default but becomes active when enabled via the auto_page configuration option. When activated, Dancer2 automatically wraps every page with a layout file to ensure consistent presentation. While these layouts are generally public-facing components intended for rendering web pages, they often contain sensitive implementation details, internal CSS or JavaScript references, and structural markup that should not be directly accessible as raw files by external users. By exploiting this path traversal flaw, an attacker can retrieve the source code of one of these layout files, potentially revealing proprietary design patterns, hardcoded secrets embedded in templates, or other architectural insights that aid further reconnaissance and potential exploitation of related vulnerabilities.
Mitigation strategies for this vulnerability involve upgrading to Dancer2 version 2.2.0 or later, where the path handling logic has been corrected to ensure consistent canonicalization before validation. For environments unable to upgrade immediately, administrators should disable the auto_page feature if it is not strictly required by their application architecture. Additionally, implementing strict input sanitization and ensuring that all file system operations use normalized paths prior to any security checks can provide a defensive layer against similar path traversal issues. It is also advisable to review server configurations to ensure they do not inadvertently normalize or decode special characters in ways that bypass application-level guards, thereby aligning the web server's behavior with the expected secure state of the application logic. This issue highlights the critical importance of ensuring consistency between validation mechanisms and actual resource access operations within dynamic web frameworks.