CVE-2026-93712: Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler
Dancer2 before 2.2.0 can serve files outside public_dir via relative path segments.
oss-security carries CVE-2026-93712, affecting the Perl web framework Dancer2 from version 2.1.0 before 2.2.0. The File route handler can serve files from outside the configured public_dir when a request uses relative path segments. Stig Palmquist posted the notice, pointing to the MetaCPAN distribution and the PerlDancer GitHub repository. The announcement does not say the flaw is being exploited.
- CVE-2026-93712 affects Dancer2 2.1.0 before 2.2.0.
- The File route handler follows relative paths outside public_dir.
- Stig Palmquist disclosed it on oss-security.
- The notice does not report exploitation in the wild.
- CVEs
- CVE-2026-93712
- Vendors
- PerlDancer
- Products
- Dancer2
- Organizations
- PerlDancer
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-93712 | Unauthenticated RCE in Dancer2 2.1.0 before 2.2.0 for Perl | 7.5 | — |
From the original article
Posted by Stig Palmquist on Sep 21 ======================================================================== https://metacpan. org/dist/Dancer2 https://github. com/PerlDancer/Dancer2 Dancer2 versions from...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.