CVE-2026-93709

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-93709

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93709.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-93709

Downstream

DEBIAN-CVE-2026-93709

Published

2026-09-22T00:50:45Z

Modified

2026-09-22T11:45:48Z

Summary

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler

Details

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler.

The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or a different capitalisation on a case-insensitive filesystem therefore misses the guard.

The handler is off by default, enabled with auto_page. The layout wrapping every page is already public, so this discloses one of the application's other layouts.

Database specific

{
    "cna_assigner":  "CPANSec",
    "cwe_ids":  [
        "CWE-41"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93709.json"
}

References

Affected packages

Git / github.com/perldancer/dancer2

Affected ranges

Type

GIT

Repo

https://github.com/perldancer/dancer2

Events

Introduced

Fixed

9931faa20d48fbd017c500a88f9236a1276c0ea9

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.2.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*

v0.02

v0.03

v0.04

v0.06

v0.08

v0.09

v0.10

v0.11

v0.12

v0.13

v0.140000

v0.140001

v0.140900_01

v0.141000

v0.142000

v0.143000

v0.149000_01

v0.149000_02

v0.150000

v0.151000

v0.152000

v0.153000

v0.153001

v0.153002

v0.154000

v0.155000

v0.155001

v0.155002

v0.155003

v0.155004

v0.156000

v0.156001

v0.157000

v0.157001

v0.158000

v0.159000

v0.159001

v0.159002

v0.159003

v0.160000

v0.160002

v0.160003

v0.161000

v0.161000_01

v0.162000

v0.162000_01

v0.163000

v0.164000

v0.165000

v0.166000

v0.166001

v0.166001_01

v0.166001_02

v0.166001_03

v0.166001_04

v0.200000

v0.200001

v0.200002

v0.200003

v0.200004

v0.201000

v0.202000

v0.203000

v0.203001

v0.204000

v0.204001

v0.204002

v0.204003

v0.204004

v0.205000

v0.205001

v0.205002

v0.206000

v0.206000_02

v0.207000

v0.208000

v0.208001

v0.208002

v0.300000

v0.300001

v0.300002

v0.300003

v0.300004

v0.300005

v0.301000

v0.301001

v0.301002

v0.301003

v0.301004

v0.400001

v1.*

v1.0.0

v1.1.0

v1.1.1

v1.1.2

v1.9999_01

v1.9999_02

v2.*

v2.0.0

v2.0.1

v2.0000_01

v2.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93709.json"