CVE-2026-78189
WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via…
- Risk score
- 67/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 31 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- WebDyne versions from 3.007 before 3.022 for Perl have a path traversal vulnerability in the PSGI API route fallback, allowing a remote attacker to run embedded Perl in any .psp file the server can read. This could lead to arbitrary code execution, data tampering, and arbitrary file access.
- Affected
- {'products': ['WebDyne'], 'packages': [], 'versions': ['3.007', '3.008', '3.009', '3.010', '3.011', '3.012', '3.013', '3.014', '3.015', '3.016', '3.017', '3.018', '3.019', '3.020', '3.021', '3.022']}
- Fix
- Upgrade to version 3.022 or later
- Exploitation
- No known exploitation
Not confirmed. 3.008, 3.009, 3.010, 3.011, 3.012, 3.013, 3.014, 3.015 isn't in the advisory. Check the vendor's advisory before acting on this.
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through api_filename. That keeps .. segments in the request path and only checks that the joined path starts with the document root, which a request for /../private passes. A remote attacker can run the embedded Perl in any .psp file the server can read, such as one uploaded to a directory outside the document root.
Last activity 31 Oct 2026. Patch Forecast updates every hour.