CVE-2026-93712

Summary

Dancer2 web framework allows directory traversal through File route handler that doesn't properly collapse relative path segments, enabling access to files outside the designated public directory. This affects applications using static_handler=0 and explicitly naming File in route_handlers.

Exploitability

Exploitation is straightforward for applications with File route handler enabled and static_handler=0, requiring only a single HTTP request with relative path traversal segments like '/../outside.txt' or encoded dots.

Blast radius

Impact could be severe as attackers can read any file the web worker process can access, including sensitive configuration files like config.yml that may contain database credentials, API keys, and application secrets.

Detection

Monitor for HTTP requests with path traversal patterns like '/../', '/./', or encoded dots (%2E%2E) in the URI path, particularly against endpoints using File route handler. Look for unusual file access patterns in web server logs or application logs that reference files outside the expected public directory structure.

Prioritized remediation

Upgrade to Dancer2 version 2.2.0 or later to fix the directory traversal vulnerability in the File route handler.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.