# CVE-2026-93712: Dancer2 path traversal in File route handler

Source: https://junglewise.ai/threats/cve-2026-93712-dancer2-versions-from-2-1-0-before-2-2-0-for-perl-serve-files  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93712 · Severity: high · CVSS 7.5 · Published 2026-09-22

Dancer2, a web framework for Perl applications, contains a path traversal vulnerability in its optional File route handler that allows attackers to read any file the web server process can access. An attacker can bypass the intended public_dir restriction using relative path segments like `/../` to reach sensitive files such as application configuration or system files. The vulnerability only affects applications that explicitly enable the File route handler while disabling the default static handler.

Technologies: [Perl Dancer Dancer2](https://junglewise.ai/threats/technologies/perl-dancer-dancer2). Vendors: [Perl Dancer](https://junglewise.ai/threats/vendors/perl-dancer).

## Quick answers

**Is CVE-2026-93712 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93712 being exploited in the wild.

**How severe is CVE-2026-93712?** High severity, with a CVSS score of 7.5, published 22 September 2026.

**Which products and versions are affected?** Perl Dancer Dancer2 2.1.0 before 2.2.0.

**Is there a fix for CVE-2026-93712?** A patch was published on 2026-08-05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93712 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-93712?** Check whether you run Perl Dancer Dancer2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The File route handler joins the request path onto public_dir using Path::Tiny without collapsing relative path segments, then checks only that the result is a readable file. Because Path::Tiny does not collapse '..' segments, paths like `/../secret.txt` escape public_dir. The fix validates that the resolved file path is contained within public_dir using realpath and subsumes checks, matching the containment logic already used in send_file.

## Affected products

- Perl Dancer Dancer2 2.1.0 before 2.2.0

## Timeline

- 2026-09-22: disclosed
- 2026-08-05: patched

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/PerlDancer/Dancer2/commit/2446a09ffb83fef71cc75c327bd6e4b1f007b885.patch](https://github.com/PerlDancer/Dancer2/commit/2446a09ffb83fef71cc75c327bd6e4b1f007b885.patch)

## Related threats

- [Dancer2 response header injection via unsanitized header names](https://junglewise.ai/threats/cve-2026-93711-dancer2-versions-before-2-2-0-for-perl-do-not-strip-cr-and-lf)
- [Dancer2 path traversal in AutoPage handler via case manipulation](https://junglewise.ai/threats/cve-2026-93709-dancer2-versions-before-2-2-0-for-perl-serve-a-layout-as-a-page)