Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-93712— Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler

Quick assessment

Affected
CVE-2026-93712
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Dancer2 的 2.1.0 至 2.2.0 之前的 Perl 版本，其 File 路由处理器（route handler）允许通过相对路径片段访问 外部目录中的文件。 该处理器在将请求路径拼接到 时，未对相对路径段（如 ）进行规范化处理，仅检查最终结果是否为一个可读的常规文件。因此，对 的请求可逃逸出 ；此外，对路径中的点号进行百分号编码（percent-encoding）也能访问到相同的文件。 该处理器默认处于禁用状态。只有当应用在 中显式指定了 处理器，并将 设置为 时，才会受到影响。因为若 保持默认值，系

AI Predicted 9.8 Difficulty: Easy EPSS 0.55% · P45

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None 2.1.0< 2.2.0 affected

I. Basic Information for CVE-2026-93712

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler
Source: CVE Program / CVE List V5
Vulnerability Description
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. The handler joins the request path onto public_dir without collapsing relative segments, and checks only that the result is a readable regular file. A request for `/../outside.txt` escapes public_dir, and percent-encoding the dots reaches the same file. The handler is off by default. An application is affected once it names File in route_handlers and sets static_handler to 0, which otherwise refuses a dot segment before the route runs. Any file the worker process can read is served to an unauthenticated request, including the application's config.yml above public_dir.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 2.1.0 ~ 2.2.0 -

II. Public POCs for CVE-2026-93712

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93712

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-93712 (1)

Other References for CVE-2026-93712 (1)

IV. Related Vulnerabilities

Same weakness: CWE-22

V. Comments for CVE-2026-93712

No comments yet

Leave a comment