CVE-2026-93709: Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler

Dancer2, a Perl web framework, mishandles path equivalence in its AutoPage handler in versions before 2.2.0, allowing a request whose path merely re-spells the layouts directory (via a doubled slash, a dot segment, a percent-encoded slash, or different capitalisation on case-insensitive filesystems) to slip past the guard, after which the canonicalising lookup serves a layout file as a regular page. The flaw is CWE-41 (improper resolution of path equivalence) and only affects applications that enable the auto_page option, which is off by default. The attacker gains read access to the contents of one of the application's other layouts — a limited information disclosure, since the layout wrapping public pages is already visible in rendered output. No CVSS score has been assigned yet, no public proof of concept exists, and the issue is not in the CISA Known Exploited Vulnerabilities catalog, with no evidence of in-the-wild exploitation.