CVE catalog

CVE-2026-93709

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the lay

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.45% · Oct 25, 2026

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or a different capitalisation on a case-insensitive filesystem therefore misses the guard. The handler is off by default, enabled with auto_page. The layout wrapping every page is already public, so this discloses one of the application's other layouts.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibdancer2-perlsid2.2.2-1fixed
Debianlibdancer2-perlforky2.2.2-1fixed
Debianlibdancer2-perltrixie1.1.2+dfsg-1vulnerable
Debianlibdancer2-perlbookworm0.400001+dfsg-1vulnerable
Opensuseperl-Dancer2tumbleweed2.2.2-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibdancer2-perlsourcesid2.2.2-1unimportantNot reported[1148732]
Debianlibdancer2-perlsourceforky2.2.2-1unimportantNot reported[1148732]
Debianlibdancer2-perlsourcetrixie(unfixed)unimportantNot reported[1148732]
Debianlibdancer2-perlsourcebookworm(unfixed)unimportantNot reported[1148732]
Opensuseperl-Dancer2rpmtumbleweed2.2.2-1.1Not reportedOPENSUSE-SU-2026:12202-1Not reported

[Debian bug #1148732]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libdancer2-perl]Affected
    Details (2)

    • 0.400001+dfsg-1 · all · bookworm

      Affected

      nvd · libdancer2-perl · debian · bookworm; nvd · libdancer2-perl · debian · 12

    • 0.400001+dfsg-1 · all · bookworm

      Affected

      nvd · libdancer2-perl · debian · bookworm; nvd · libdancer2-perl · debian · 12

[Debian 13 (Trixie)]

  • [libdancer2-perl]Affected
    Details (2)

    • 1.1.2+dfsg-1 · all · trixie

      Affected

      nvd · libdancer2-perl · debian · 13

    • 1.1.2+dfsg-1 · all · trixie

      Affected

      nvd · libdancer2-perl · debian · 13

[openSUSE Tumbleweed]

  • [perl-Dancer2]Affected

    Source package: [perl-Dancer2]

    Details (1)

    • 1.1.2-1.6 · noarch · tumbleweed

      Affected · Fixed: 2.2.2-1.1

      nvd · perl-Dancer2 · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]