Executive brief
Dancer2, a web framework for Perl applications, contains a path traversal vulnerability in its optional File route handler that allows attackers to read any file the web server process can access. An attacker can bypass the intended public_dir restriction using relative path segments like `/../` to reach sensitive files such as application configuration or system files. The vulnerability only affects applications that explicitly enable the File route handler while disabling the default static handler.
Technical details
The File route handler joins the request path onto public_dir using Path::Tiny without collapsing relative path segments, then checks only that the result is a readable file. Because Path::Tiny does not collapse '..' segments, paths like `/../secret.txt` escape public_dir. The fix validates that the resolved file path is contained within public_dir using realpath and subsumes checks, matching the containment logic already used in send_file.
Affected products
- Perl Dancer Dancer2 2.1.0 before 2.2.0
Timeline
- 2026-09-22: disclosed
- 2026-08-05: patched