CVE-2026-78192 Details
Description
WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page. WebDyne's wrapper scripts, such as webdyne.psgi, enable the built-in index page by default. Its source viewer returns files under the document root named in the source parameter of an HTMX request, including .psp, .pm and .pl files. A remote attacker can read the application's Perl code, including the __PERL__ blocks of .psp pages and any credentials they hold.
A vulnerability in WebDyne versions 2.022 prior to 3.022 for Perl allows unauthenticated clients to access application source code through the default index page viewer. The issue arises because WebDyne's wrapper scripts, such as webdyne.psgi, enable the index page source viewer by default. This viewer can return files located under the specified document root, including .psp, .pm, and .pl files, based on the source parameter of an HTMX request. As a result, a remote attacker could read the application's Perl code, including sensitive credentials embedded in the __PERL__ blocks of .psp pages.
WebDyne version 3.022 has addressed this vulnerability by changing the default behavior of the wrapper scripts to disable the source viewer and index handling, unless explicitly enabled. Users should upgrade to WebDyne 3.022 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 31, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/ASPEER/WebDyne-3.022/changes | CPANSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | CPANSec |
| CWE-540 | Inclusion of Sensitive Information in Source Code | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| WebDyne | >= 2.022, < 3.022 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 31, 2026 | New CVE Received | CPANSec |