Executive brief
Dancer2 is a lightweight web application framework for Perl. Versions before 2.2.0 allow attackers to retrieve private layout templates by requesting them with different path spellings (uppercase, dot segments, encoded slashes) that bypass the protection check but resolve to the same file on case-insensitive filesystems like macOS and Windows. Since layout templates are wrapped around every page in a Dancer2 application, this leaks information about the application's structure.
Technical details
The AutoPage handler in Dancer2 compares the request path as a string against the layout directory name to prevent serving layouts as pages, but a case-insensitive filesystem allows an attacker to request the same file with different capitalization (e.g., /Layouts instead of /layouts) that bypasses the text comparison while the filesystem lookup canonicalizes it to the same file. The vulnerability is exploitable only when AutoPage is enabled via configuration; affected components include path-to-file resolution logic that fails to resolve paths before making the access control decision.
Affected products
- Perl Dancer Dancer2 before 2.2.0
Timeline
- 2026-09-22: disclosed
- 2026-08-05: patched: Fix committed to repository