CVE-2026-78191 Details
Description
WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor. An application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.
A vulnerability exists in WebDyne versions 2.031 prior to 3.022, allowing files with a .psp extension to be executed as Perl pages. This issue arises because WebDyne's extension matching regex does not properly anchor the end of the string, enabling remote attackers to upload files like report.psp.pdf that execute embedded Perl when accessed. The vulnerability takes advantage of an upload mechanism that only verifies the final file extension.
Users can update to WebDyne version 3.022 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 31, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/ASPEER/WebDyne-3.022/changes | CPANSec | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-777 | Regular Expression without Anchors | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| WebDyne | >= 2.031, < 3.022 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 31, 2026 | New CVE Received | CPANSec |