CVE-2026-93709
CVE-2026-93709
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or a different capitalisation on a case-insensitive filesystem therefore misses the guard. The handler is off by default, enabled with auto_page. The layout wrapping every page is already public, so this discloses one of the application's other layouts.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (39.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 39.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.005 · change: +0.001
Weakness classification (CWE)
References
- 9b29abf9-4ab0-4765-b253-1875cd9b441e (issue-tracking)
- 9b29abf9-4ab0-4765-b253-1875cd9b441e (patch)
- 9b29abf9-4ab0-4765-b253-1875cd9b441e (patch)
- 9b29abf9-4ab0-4765-b253-1875cd9b441e (release-notes)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2026-93709?
- CVE-2026-93709 is a medium-severity vulnerability, classified under CWE-41. CVSS score: 5.3/10. Published 2026-09-22.
- How severe is CVE-2026-93709?
- Medium severity. CVSS v3 base score is 5.3 out of 10.