Layout Exposure Vulnerability in Dancer2 by Perl
CVE-2026-93709
What is CVE-2026-93709?
Dancer2, a web application framework written in Perl, has a vulnerability that allows for layout exposure when certain request paths bypass guard mechanisms in the AutoPage handler. This issue occurs due to improper handling of path canonicalization. Specifically, variations in path spelling, such as doubled slashes or different capitalizations on case-insensitive filesystems, may allow access to layouts that should remain protected. While the AutoPage feature is off by default, enabling it can inadvertently lead to the exposure of sensitive layout files that could inform malicious users about the application's structure. It's essential for users of Dancer2 to adopt the latest release (version 2.2.0 or later) to mitigate this vulnerability.