Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it
Summary
| CVE | CVE-2026-95811 |
|---|---|
| State | PUBLISHED |
| Assigner | CPANSec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-25 02:16:54 UTC |
| Updated | 2026-09-25 14:17:24 UTC |
| Description | Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it. The handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike. Only a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants. |
Risk And Classification
Primary CVSS: v3.1 6.5 MEDIUM from ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.002520000 probability, percentile 0.148980000 (date 2026-09-25)
Problem Types: CWE-180 | CWE-863 | CWE-863 CWE-863 Incorrect Authorization | CWE-180 CWE-180 Incorrect Behavior Order: Validate Before Canonicalize
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | DECLARED | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
HighAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
There are no known software configurations currently associated with this CVE in NVD or the CVE Program record.
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.16.10 | 9b29abf9-4ab0-4765-b253-1875cd9b441e | gitlab.ow2.org | |
| www.cve.org/CVERecord | 9b29abf9-4ab0-4765-b253-1875cd9b441e | www.cve.org | |
| gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3723 | 9b29abf9-4ab0-4765-b253-1875cd9b441e | gitlab.ow2.org | |
| gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/3723 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | gitlab.ow2.org | |
| gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.23.4 | 9b29abf9-4ab0-4765-b253-1875cd9b441e | gitlab.ow2.org | |
| gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.21.6 | 9b29abf9-4ab0-4765-b253-1875cd9b441e | gitlab.ow2.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Deepseek agent, Linagora (en)
Additional Advisory Data
Solutions
CNA: Upgrade to Lemonldap-NG-Handler 2.16.10, 2.21.6 or 2.23.4 or later. Only 2.23.4 is on CPAN; the 2.16.10 and 2.21.6 LTS releases are available from https://lemonldap-ng.org/download.html.
There are currently no legacy QID mappings associated with this CVE.