CVE-2026-93712 in Dancer2
Summary
by MITRE • 09/22/2026
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler.
The handler joins the request path onto public_dir without collapsing relative segments, and checks only that the result is a readable regular file. A request for `/../outside.txt` escapes public_dir, and percent-encoding the dots reaches the same file.
The handler is off by default. An application is affected once it names File in route_handlers and sets static_handler to 0, which otherwise refuses a dot segment before the route runs.
Any file the worker process can read is served to an unauthenticated request, including the application's config.yml above public_dir.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified involves Dancer2 versions ranging from 2.1.0 up to but not including version 2.2.0 for Perl, specifically affecting the File route handler within its static file serving mechanism. This flaw constitutes a path traversal issue where an attacker can exploit relative path segments in HTTP requests to access files located outside of the designated public directory. The core technical failure lies in how the framework constructs the file system path from incoming request URIs. Instead of normalizing or collapsing relative path components such as dot-dot sequences, the handler simply concatenates the requested path segment with the base public directory path. This lack of proper sanitization allows an attacker to use standard traversal patterns like ../ to move up the directory hierarchy and access sensitive files that reside in parent directories or other parts of the file system accessible by the worker process.
The operational impact of this vulnerability is severe, as it enables unauthorized data exfiltration without requiring any form of authentication. Since Dancer2 checks only whether the resulting path points to a readable regular file after joining the paths, an attacker can craft requests that bypass directory restrictions entirely. For instance, requesting /../outside.txt or utilizing percent-encoded variants such as %2e%2e/ will successfully resolve to files outside the intended public scope. This means that any configuration files, environment variables stored in plain text, database credentials, or other sensitive application data located above the web root can be downloaded by an unauthenticated remote attacker. The severity is further compounded because this behavior occurs even when static_handler settings are configured to restrict access, provided the specific File route handler is explicitly named and activated while static_handler is set to zero.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. It also maps to MITRE ATT&CK techniques related to Collection via Local File Inclusion and potentially T1530 if used in conjunction with other data exfiltration methods. The flaw represents a classic input validation failure where user-supplied input is not adequately sanitized before being used in file system operations. This allows the application logic to be subverted, leading to unauthorized access to restricted resources that were intended to remain private from web-facing clients.
Mitigation strategies for this vulnerability primarily involve upgrading the Dancer2 framework to version 2.2.0 or later, where the path handling logic has been corrected to properly collapse relative segments and enforce strict directory boundaries. For applications unable to upgrade immediately, developers should implement additional input validation layers within their route handlers to explicitly reject any request paths containing dot-dot sequences or encoded equivalents of such characters. Furthermore, ensuring that static_handler is enabled by default can provide a secondary layer of defense, as the framework's built-in static file serving mechanism includes protections against directory traversal attempts before custom routes are executed. It is also critical to review application configurations to ensure that sensitive files like config.yml are not stored in directories accessible via relative path manipulation and to adhere to the principle of least privilege by restricting the read permissions of the worker process to only those files strictly necessary for operation.