Dancer2 versions prior to 2.2.0 contain a flaw in the AutoPage handler where the request path is compared as plain text against the layout directory name, while the subsequent lookup canonicalises the path. Because of this, differences such as a doubled slash, a dot segment, a percent‑encoded slash, or case variations on a case‑insensitive filesystem bypass the guard. When this occurs an attacker can request a layout file and receive it as a normal page, effectively exposing the content of the layout (which is normally only used for internal wrapping). The vulnerability therefore results in the disclosure of potentially sensitive templating code or application structure, an instance of information disclosure classified as CWE‑41.

The affected product is Dancer2 for Perl. Any installation of Dancer2 with a version earlier than 2.2.0 that has the AutoPage feature enabled (auto_page) is susceptible. This includes users running 2.0.x, 2.1.x, and other pre‑2.2.0 releases on any operating system, regardless of case sensitivity of the file system.

The vulnerability can be exploited via a crafted HTTP GET request that uses path variations to reach the layout directory. No privileged access or authentication is required; the AutoPage handler is enabled by default only when the application author explicitly turns it on. The CVSS score of 5.3 indicates moderate severity, and the EPSS score of <1% shows a very low probability of exploitation. Because the patch release exists and there is no evidence of exploitation listed in the KEV catalog, the risk remains moderate, and the exposure is limited to the contents of the layout files.