WebDyne for Perl has five CVEs including cookie and path traversal issues
WebDyne versions 2.014-3.022 for Perl issue insecure session cookies and allow path traversal in PSGI API.
20
CVE-2026-78189
Path traversal RCE in WebDyne Perl before 3.022
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
WebDyne Perl versions 3.007 to 3.021 execute .psp files outside the document root via path traversal in the PSGI API route fallback. A remote attacker triggers it by requesting paths with ../ segments that match no file but retry as an API route. This allows running embedded Perl code from any readable .psp file outside the document root. All WebDyne Perl users are affected.
What to do: Apply WebDyne's update for CVE-2026-78189. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| WebDyne Perl | 3.007 before 3.022 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through api_filename. That keeps .. segments in the request path and only checks that the joined path starts with the document root, which a request for /../private passes. A remote attacker can run the embedded Perl in any .psp file the server can read, such as one uploaded to a directory outside the document root.
- Weakness
- CWE-22