AI analysis
Dancer2, a Perl web framework, mishandles path equivalence in its AutoPage handler in versions before 2.2.0, allowing a request whose path merely re-spells the layouts directory (via a doubled slash, a dot segment, a percent-encoded slash, or different capitalisation on case-insensitive filesystems) to slip past the guard, after which the canonicalising lookup serves a layout file as a regular page. The flaw is CWE-41 (improper resolution of path equivalence) and only affects applications that enable the auto_page option, which is off by default. The attacker gains read access to the contents of one of the application's other layouts — a limited information disclosure, since the layout wrapping public pages is already visible in rendered output. No CVSS score has been assigned yet, no public proof of concept exists, and the issue is not in the CISA Known Exploited Vulnerabilities catalog, with no evidence of in-the-wild exploitation.
What to do: Upgrade Dancer2 to 2.2.0 or later, where the guard correctly handles equivalent path spellings. If upgrading is not immediately possible, disable auto_page or reject/normalise request paths containing doubled slashes, dot segments, or percent-encoded slashes (and be mindful of case-insensitive filesystems) before they reach the handler. Review access logs for requests matching layout directory paths spelled with these variants, which would indicate probing for this issue.
Affected
| PerlDancer (Dancer2 project) Dancer2 | before 2.2.0 |
Estimated exposure
nicheunknown; plausibly hundreds to a few thousand apps, likely under 10,000 — Dancer2 is a niche CPAN framework with no public deployment or active-install counts, and the vulnerable AutoPage handler is disabled unless the application opts in via auto_page, so only a subset of Dancer2 sites are reachable.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or a different capitalisation on a case-insensitive filesystem therefore misses the guard. The handler is off by default, enabled with auto_page. The layout wrapping every page is already public, so this discloses one of the application's other layouts.