Dancer2 CVE-2026-93709

Requires the AutoPage handler to be explicitly enabled via the auto_page configuration setting, which is OFF by default in Dancer2 - this is the primary limiting factor. Given that, an unauthenticated remote attacker submits a request whose path is an equivalent spelling of the layout directory (a doubled slash, a /./ dot segment, a percent-encoded slash, or a different capitalisation), which misses the handler's literal text guard while the subsequent view lookup canonicalises it to the real file. The capitalisation-variant additionally requires a case-insensitive filesystem (typically macOS or Windows hosts); the doubled-slash, dot-segment and percent-encoded-slash variants work on any filesystem. Impact is confined to disclosure of one of the application's other layout templates - no code execution, no credentials, no write access.

This is a genuinely low-priority information-disclosure flaw despite the network attack vector. The CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects unauthenticated remote access with only limited confidentiality impact and no integrity or availability effect - consistent with CWE-41 path-equivalence leaking a template rather than code execution or credential theft. EPSS reinforces low real-world risk at 0.19% (8th percentile), and there is no CISA KEV listing and no public exploit code (only the upstream issue and patch commits), so exploitation status is 'no public exploit identified at time of analysis.' A critical mitigating fact not captured in the base score: the vulnerable AutoPage handler is OFF BY DEFAULT and only active when an operator sets auto_page, and the capitalisation-variant of the bypass additionally requires a case-insensitive filesystem (macOS/Windows). No signals conflict here - CVSS, EPSS, and the disclosed-impact all point the same direction. Net: a real but minor bug, correctly rated MEDIUM/LOW; the main confidentiality loss is one additional non-active layout template, which the vendor advisory itself notes is close to already-public content.

An attacker who notices a Dancer2 app has auto_page enabled requests a layout path using an equivalent spelling - e.g. a doubled slash, a /./ dot segment, a percent-encoded slash, or a differently-cased path on a case-insensitive host - so the request slips past the AutoPage text-comparison guard while the follow-on lookup canonicalises it to the real file. The handler then renders and returns one of the application's non-default layout templates. No public exploit code exists, but the technique is trivial to reproduce from the description and patch.