CyberRota Analysis
AI-GeneratedDancer2 versions from 2.1.0 to 2.2.0 are vulnerable to a path traversal issue that allows unauthorized access to files outside the designated public directory, including sensitive configuration files. This vulnerability can be exploited by sending crafted requests that leverage relative path segments, potentially exposing any file the worker process can read. Developers using Dancer2 who have enabled the File route handler and disabled the static handler should prioritize remediation to prevent unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. The handler joins the request path onto public_dir without collapsing relative segments, and checks only that the result is a readable regular file. A request for `/../outside.txt` escapes public_dir, and percent-encoding the dots reaches the same file. The handler is off by default. An application is affected once it names File in route_handlers and sets static_handler to 0, which otherwise refuses a dot segment before the route runs. Any file the worker process can read is served to an unauthenticated request, including the application's config.yml above public_dir.