Is CVE-2026-93712 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93712 being exploited in the wild.

How severe is CVE-2026-93712?

High severity, with a CVSS score of 7.5, published 22 September 2026.

Which products and versions are affected?

Perl Dancer Dancer2 2.1.0 before 2.2.0.

Is there a fix for CVE-2026-93712?

A patch was published on 2026-08-05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-93712 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-93712?

Check whether you run Perl Dancer Dancer2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93712: Dancer2 path traversal in File route handler

CVE-2026-93712 · Severity: high · CVSS 7.5 · Published 2026-09-22

Dancer2, a web framework for Perl applications, contains a path traversal vulnerability in its optional File route handler that allows attackers to read any file the web server process can access. An attacker can bypass the intended public_dir restriction using relative path segments like `/../` to reach sensitive files such as application configuration or system files. The vulnerability only affects applications that explicitly enable the File route handler while disabling the default static handler.

Technologies: Perl Dancer Dancer2. Vendors: Perl Dancer.

Quick answers

Is CVE-2026-93712 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93712 being exploited in the wild.
How severe is CVE-2026-93712?: High severity, with a CVSS score of 7.5, published 22 September 2026.
Which products and versions are affected?: Perl Dancer Dancer2 2.1.0 before 2.2.0.
Is there a fix for CVE-2026-93712?: A patch was published on 2026-08-05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93712 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-93712?: Check whether you run Perl Dancer Dancer2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The File route handler joins the request path onto public_dir using Path::Tiny without collapsing relative path segments, then checks only that the result is a readable file. Because Path::Tiny does not collapse '..' segments, paths like `/../secret.txt` escape public_dir. The fix validates that the resolved file path is contained within public_dir using realpath and subsumes checks, matching the containment logic already used in send_file.

Affected products

Perl Dancer Dancer2 2.1.0 before 2.2.0

Timeline

2026-09-22: disclosed
2026-08-05: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.