DEBIAN-CVE-2026-93712

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request...

CVE-2022-29970: Improper Limitation of a Pathname to a Restricted Directory

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files...