This vulnerability allows an attacker to request files outside the intended public directory by supplying relative path segments in the URL. The request path is concatenated to the public_dir without normalizing or collapsing segments, and the handler only verifies that the resulting path is a readable file. Consequently, arbitrary files that the worker process can read, including configuration files such as config.yml, can be served to any unauthenticated request. The impact is a clear information disclosure of potentially sensitive data held by the application.

Any Perl application using Dancer2 versions 2.1.0 through any pre‑2.2.0 release is affected when the application defines a File route handler and sets static_handler to 0. The vulnerability is not present by default; it requires explicit route configuration. The exploitation would allow reading any file on the filesystem that the worker process has permissions to access.

The exploit can be performed via a simple HTTP request to the vulnerable route. No additional credentials or privileges are required. The CVSS score of 7.5 indicates a high severity, while the EPSS score of < 1% suggests a low current exploitation probability. The ability to read arbitrary system files poses a significant risk to confidentiality. Because the attack is unauthenticated and based solely on path manipulation, the potential impact is high for affected deployments. This vulnerability is not listed in the CISA KEV catalog at this time.