CVE-2026-93712: Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler
Dancer2 before 2.2.0 can serve files outside public_dir via relative path segments.
44
Organization
PerlDancer
- Mentions · 7d0
- Mentions · 30d0
- All mentions4
- First seenSep 22, 2026
- Last mentionedSep 22, 2026
Timeline
4 articles · newest firstCVE-2026-93711: Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array
Dancer2 before 2.2.0 leaves CR and LF in response header names, enabling header injection.
40
CVE-2026-93710: Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks
Dancer2 before 2.2.0 can dispatch a route a dying hook refused when compile_hooks exception handling halts the response.
42
CVE-2026-93709: Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler
Dancer2 before 2.2.0 can serve a layout as a page when an alternate path spelling bypasses the AutoPage guard.
38
Related CVEs
by mentions- Unauthenticated RCE in Dancer2 2.1.0 before 2.2.0 for Perl
- Unauthenticated Route Refusal in Dancer2 Versions 2.0.0-2.1.9
- Unauthenticated Header Splitting in Dancer2 Perl Before 2.2.0
- Path-Equivalence Bypass in Dancer2 AutoPage (pre-2.2.0) Leaks Layout Templates
Appears with
- Dancer2product · 4
- PerlDancervendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.