CVE-2026-93709

Dancer2 versions before 2.2.0 for Perl contain a path-normalization bypass in the AutoPage handler (disabled by default, enabled via auto_page). The handler compares the request path against the layout directory name as plain text, while the subsequent file lookup canonicalises the path. This mis...