CVE-2015-10149
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 14, 2026
Vendor
unknown
Description
Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine. read_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session. A remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it.