CVE-2026-78191
WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as…
- Risk score
- 72/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 31 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- WebDyne for Perl allows remote attackers to execute files with .psp anywhere in the name as Perl pages, allowing them to run embedded Perl code. This can be done by uploading a malicious file and requesting it.
- Affected
- {'products': ['WebDyne'], 'packages': [], 'versions': ['2.031', '3.022']}
- Fix
- Upgrade to version 3.022 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor. An application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.
Last activity 31 Oct 2026. Patch Forecast updates every hour.