DEBIAN-CVE-2026-93712
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-93712
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93712.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-93712
- Upstream
- Published
- 2026-09-22T01:16:55Z
- Modified
- 2026-09-22T06:47:22Z
- Summary
- [none]
- Details
-
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. The handler joins the request path onto public_dir without collapsing relative segments, and checks only that the result is a readable regular file. A request for
/../outside.txtescapes public_dir, and percent-encoding the dots reaches the same file. The handler is off by default. An application is affected once it names File in route_handlers and sets static_handler to 0, which otherwise refuses a dot segment before the route runs. Any file the worker process can read is served to an unauthenticated request, including the application's config.yml above public_dir. - References
Affected packages
Debian:12 / libdancer2-perl
Package
- Name
- libdancer2-perl
- Purl
- pkg:deb/debian/libdancer2-perl?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:13 / libdancer2-perl
Package
- Name
- libdancer2-perl
- Purl
- pkg:deb/debian/libdancer2-perl?arch=source&distro=trixie
Debian:14 / libdancer2-perl
Package
- Name
- libdancer2-perl
- Purl
- pkg:deb/debian/libdancer2-perl?arch=source&distro=forky