Dancer2 CVE-2026-93712

Exploitation requires a specific non-default deployment: the application must (1) name File in its route_handlers configuration to activate Dancer2::Handler::File, and (2) set static_handler to 0 - because the default static handler collapses/refuses dot segments before the File route runs, and leaving it enabled blocks the attack. When both conditions are met, no authentication or user interaction is needed: an unauthenticated remote GET request containing relative path segments (/../outside.txt) or percent-encoded dots escapes public_dir and returns any file readable by the worker process, including config.yml stored above public_dir. The limiting factor is entirely the non-default configuration; default Dancer2 applications (File handler absent, or static_handler enabled) are not affected.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects an unauthenticated, network-reachable path-traversal that discloses arbitrary worker-readable files (C:H), with no integrity or availability impact - consistent with the CWE-22 classification and the 'Information Disclosure' tag. However, the raw score materially overstates real-world exposure because the affected code path is gated by non-default configuration: the File route handler is off by default and only becomes reachable when an application explicitly names File in route_handlers AND sets static_handler to 0 (the static handler otherwise rejects dot segments before the route runs). Corroborating signals point to low urgency: EPSS is 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit code is identified in the provided intelligence. The mechanism is trivially exploitable where present (a simple GET for /../outside.txt, or percent-encoded dots), so AC:L is fair, but the aggregate picture is a genuine-but-config-limited flaw rather than a widespread emergency. No conflicting signals were found - the CVSS vector, description, and patch diff all agree the impact is confidentiality-only and remote-unauthenticated within the vulnerable configuration.

An application that opts into Dancer2::Handler::File and disables the static handler (static_handler: 0) is deployed publicly. An unauthenticated attacker sends GET /../config.yml (or a percent-encoded variant like /..%2fconfig.yml), and the handler joins the path onto public_dir without collapsing '../' segments, serving the file because it only checks that the target is a readable regular file - exposing the application config and any other file the worker process can read. No public exploit code is identified at time of analysis, though the technique is elementary and reliably reproducible.