Technical impact
The defect in Perl Dancer versions older than 1.3400 allows a session ID from a cookie to be passed to the session engine without any validation. This flaw can enable a remote attacker to inject malicious characters into the session ID, potentially leading to path traversal, command injection, or SQL injection if the session engine uses the ID directly in file paths, cache commands, or database queries. The consequence is that an attacker could execute arbitrary code or compromise the confidentiality and integrity of the application.
Affected Systems
The affected product is the Dancer web framework for Perl, with the issue present in all releases before 1.3400. No specific vendor and product list beyond the Dancer project is provided; users should check the version of Dancer installed on their servers, and if it is older than 1.3400, the vulnerability applies.
Risk and Exploitability
The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so there is no public evidence of exploitation yet. Nevertheless, the flaw can be exploited by an attacker who can set the session cookie, which is often possible through a malicious web page or phishing. The absence of validation means the exploitation path is straightforward and likely to succeed if the session engine is vulnerable to file path or command injection. The risk is moderate to high, especially in environments where Dancer is exposed to untrusted clients and the session engine does not perform its own sanitization.
