CVE-2026-93709: Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler
Dancer2 before 2.2.0 can serve a layout as a page when an alternate path spelling bypasses the AutoPage guard.
CVE-2026-93709 affects Perl Dancer2 versions before 2.2.0. An equivalent spelling of a layout path can miss the guard in the AutoPage handler, causing the framework to serve that layout as a page. The oss-security post, also from Stig Palmquist, does not report observed exploitation.
- Affects all Dancer2 versions before 2.2.0.
- An equivalent path spelling misses the AutoPage guard.
- The framework can serve a layout as a page.
- Disclosure does not report active exploitation.
- CVEs
- CVE-2026-93709
- Products
- Dancer2
- Organizations
- PerlDancer
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-93709 | Path-Equivalence Bypass in Dancer2 AutoPage (pre-2.2.0) Leaks Layout Templates | 5.3 | — |
From the original article
Posted by Stig Palmquist on Sep 21 ======================================================================== https://metacpan. org/dist/Dancer2 https://github. com/PerlDancer/Dancer2 Dancer2 versions before 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.