CVE-2026-93709

Katalog CVE

CVSS 5.3 · Medium EPSS 0,33%

Kerentanan Improper Resolution of Path Equivalence. Skor CVSS 3.1 5.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or a different capitalisation on a case-insensitive filesystem therefore misses the guard. The handler is off by default, enabled with auto_page. The layout wrapping every page is already public, so this discloses one of the application's other layouts.

Rincian

Terbit di NVD

22 September 2026

Terakhir diubah

23 September 2026

Status NVD

Deferred

CVSS 3.1

5.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-41: Improper Resolution of Path Equivalence

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/PerlDancer/Dancer2/commit/293fce08812b0928f34ab2d7b9357450707c3630.patch
• https://github.com/PerlDancer/Dancer2/commit/753b385350a54acb8d4b686723890205268634a8.patch
• https://github.com/PerlDancer/Dancer2/issues/1823
• https://metacpan.org/release/CROMEDOME/Dancer2-2.2.0/changes
• http://www.openwall.com/lists/oss-security/2026/09/22/1