The handler joins the request path onto public_dir without collapsing relative segments, and checks only that the result is a readable regular file. A request for `/../outside.txt` escapes public_dir, and percent-encoding the dots reaches the same file.
The handler is off by default. An application is affected once it names File in route_handlers and sets static_handler to 0, which otherwise refuses a dot segment before the route runs.
Any file the worker process can read is served to an unauthenticated request, including the application's config.yml above public_dir.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to Dancer2 2.2.0 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 22 Sep 2026 03:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Tue, 22 Sep 2026 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. The handler joins the request path onto public_dir without collapsing relative segments, and checks only that the result is a readable regular file. A request for `/../outside.txt` escapes public_dir, and percent-encoding the dots reaches the same file. The handler is off by default. An application is affected once it names File in route_handlers and sets static_handler to 0, which otherwise refuses a dot segment before the route runs. Any file the worker process can read is served to an unauthenticated request, including the application's config.yml above public_dir. | |
| Title | Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler | |
| Weaknesses | CWE-22 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-09-22T02:09:48.478Z
Reserved: 2026-09-18T15:07:22.163Z
Link: CVE-2026-93712
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-22T01:16:55.957
Modified: 2026-09-22T03:16:58.843
Link: CVE-2026-93712
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-09-22T02:30:07Z
-
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')