---
id: "CVE-2015-10149"
page: "https://infrastack.ai/live/CVE-2015-10149"
kind: "vulnerability"
aliases: ["CVE-2015-10149"]
title: "Dancer for Perl: unchecked session cookie ids can reach session storage"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dancer", "package", "perl", "web-apps"]
not_affected_if: ["managed-hosting", "no-sessions"]
published_at: "2026-11-14T20:17:39+00:00"
first_seen_at: "2026-11-14T20:33:12+00:00"
updated_at: "2026-11-14T20:35:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-10149", "first_seen_at": "2026-11-14T20:33:12+00:00"}]
exploit_sources: []
---

# Dancer for Perl: unchecked session cookie ids can reach session storage

Link for people: https://infrastack.ai/live/CVE-2015-10149 (this .md is for agents)

Dancer versions before 1.3400 for Perl take the session id from the session cookie without checking its characters and pass it to the session engine. A remote attacker who sets the cookie may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Dancer version with `perl -MDancer -e 'print $Dancer::VERSION'`
- Look for session engines in the app config that store sessions as files, in a cache, or in a database
- Check whether session cookies are read by the app without validation

## Fix

- Dancer: `1.3400` or later (per the sources, the fix is in versions before 1.3400 being affected)

## Timeline

- 2026-11-14T20:33:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2015-10149

## Documents

- [fix] Patch: github.com https://github.com/PerlDancer/Dancer/commit/5a68fddbaef903fd3bd58517ce585cde986716e4.patch

## From the sources

Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine.

read_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session.

A remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_