Quick answers
- Is CVE-2026-93709 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-93709 being exploited in the wild.
- How severe is CVE-2026-93709?
- Medium severity, with a CVSS score of 5.3, published 22 September 2026.
- Which products and versions are affected?
- Perl Dancer Dancer2 before 2.2.0.
- Is there a fix for CVE-2026-93709?
- A patch was published on 2026-08-05: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-93709 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-93709?
- Check whether you run Perl Dancer Dancer2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The AutoPage handler in Dancer2 compares the request path as a string against the layout directory name to prevent serving layouts as pages, but a case-insensitive filesystem allows an attacker to request the same file with different capitalization (e.g., /Layouts instead of /layouts) that bypasses the text comparison while the filesystem lookup canonicalizes it to the same file. The vulnerability is exploitable only when AutoPage is enabled via configuration; affected components include path-to-file resolution logic that fails to resolve paths before making the access control decision.
Affected products
- Perl Dancer Dancer2 before 2.2.0
Timeline
- 2026-09-22: disclosed
- 2026-08-05: patched: Fix committed to repository