Threats affecting pkg:cpan/Dancer2

CVE-2026-93712 is a path traversal vulnerability in Dancer2 versions from 2.1.0 before 2.2.0 for Perl. The File route handler improperly serves files outside the configured public_dir by not collapsing relative path segments, allowing requests with path traversal sequences to access arbitrary readable files. This vulnerability is exploitable when the File handler is enabled and static_handler is disabled, potentially exposing sensitive files such as configuration files to unauthenticated users.

Dancer2 versions before 2.2.0 for Perl contain a vulnerability where CR and LF characters are not stripped from HTTP response header names. This allows an attacker controlling header names to inject additional headers by splitting the HTTP response. The vulnerability is classified as CWE-113, HTTP Response Splitting, and has a medium severity with a CVSS score of 6.5.

CVE-2026-93710 affects Dancer2 versions from 2.0.0 up to but not including 2.2.0. It involves improper cleanup when an exception is thrown in a hook during request dispatch. Specifically, if an exception handler halts the response without properly invoking the halt method or setting the is_halted flag, cleanup does not prevent the refused route from running, potentially causing unintended request processing. This vulnerability has a high severity score of 7.5 due to its impact on availability.

CVE-2026-93709 is a vulnerability in Dancer2 for Perl versions before 2.2.0 where the AutoPage handler improperly resolves path equivalence. This allows certain path variants (such as doubled slashes, dot segments, percent-encoded slashes, or case differences on case-insensitive filesystems) to bypass a guard check and serve a layout as a page. The vulnerability is off by default and only present when auto_page is enabled. The disclosed layout is already public, so the impact is limited to revealing one of the application's other layouts.

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.