CVE-2026-93709mediumCWE-41

CVE-2026-93709: fallo de gravedad media en Dancer2

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Dancer2+ Monitorear libdancer2-perl

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.5%
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or a different capitalisation on a case-insensitive filesystem therefore misses the guard. The handler is off by default, enabled with auto_page. The layout wrapping every page is already public, so this discloses one of the application's other layouts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
Dancer2
CVEs relacionadas — Dancer2

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-93710HIGHDancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooksEPSS 0.6%CVE-2026-13577HIGHDancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailableEPSS 0.6%CVE-2026-93712HIGHDancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handlerEPSS 0.5%CVE-2026-93711MEDIUMDancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_arrayEPSS 0.4%