CVE-2026-78189 Details
Description
WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through api_filename. That keeps .. segments in the request path and only checks that the joined path starts with the document root, which a request for /../private passes. A remote attacker can run the embedded Perl in any .psp file the server can read, such as one uploaded to a directory outside the document root.
A path traversal vulnerability has been identified in WebDyne versions 3.007 prior to 3.022. The issue arises in the PSGI API route fallback, where the application executes .psp files located outside the document root. When a request does not match any file, the PSGI handler reprocesses it as an API route, retaining the .. segments in the path. This allows requests to access files outside the intended directory, such as /../private. A remote attacker can exploit this to execute embedded Perl in any accessible .psp file, including those uploaded to directories outside the document root.
Users are advised to update WebDyne to version 3.022 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 31, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/ASPEER/WebDyne-3.022/changes | CPANSec | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| WebDyne | >= 3.007, < 3.022 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 31, 2026 | New CVE Received | CPANSec |