CVE-2015-10149 · Package
NO FIX YET · SEE WHAT TO DO
Dancer versions before 1.3400 for Perl take the session id from the session cookie without checking its characters and pass it to the session engine. A remote attacker who sets the cookie may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Perl web applications built on Dancer that use a session engine which builds a file path, cache command or query from the session id. Apps that do not use sessions, or that use a session engine that does not take the id from the cookie unchecked, are less exposed. The sources do not say which session engines are unsafe.
Not affected if managed-hosting, no-sessions
Who cares dancer, perl, web-apps
perl -MDancer -e 'print $Dancer::VERSION'1.3400 or later (per the sources, the fix is in versions before 1.3400 being affected)Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine.
read_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session.
A remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.