CVE-2026-93712: Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler

Dancer2 versions from 2.1.0 before 2.2.0 contain a vulnerability in the File route handler that allows unauthenticated access to files outside public_dir via relative path segments. An attacker can use requests like /../outside.txt or percent-encoded dots to reach arbitrary files, including application config.yml. The flaw is enabled when the File route handler is named and static_handler is set to 0, and it can serve any file the worker process can read without authentication.

Do: Upgrade to Dancer2 2.2.0 or later. Disable the File route handler or set static_handler to 0 to prevent serving files outside public_dir. Verify that no attacker-controlled path or request can reach config.yml or other files outside public_dir.