Threats tagged 'ghsa-8fpv-59mj-6jfr'

CVE-2026-93709 is a vulnerability in Dancer2 for Perl versions before 2.2.0 where the AutoPage handler improperly resolves path equivalence. This allows certain path variants (such as doubled slashes, dot segments, percent-encoded slashes, or case differences on case-insensitive filesystems) to bypass a guard check and serve a layout as a page. The vulnerability is off by default and only present when auto_page is enabled. The disclosed layout is already public, so the impact is limited to revealing one of the application's other layouts.