WebDyne for Perl has five CVEs including cookie and path traversal issues
WebDyne versions 2.014-3.022 for Perl issue insecure session cookies and allow path traversal in PSGI API.
20
CVE-2026-78190
XSS in WebDyne for Perl before 3.022
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
WebDyne for Perl versions 2.014 before 3.022 reflect request parameters unescaped into textfield, password_field and filefield tags. Attackers craft links to inject scripts into pages. Remote unauthenticated users can trigger it. Affected are WebDyne for Perl users on vulnerable versions.
What to do: Upgrade to WebDyne for Perl 3.022. No workaround mentioned.
| Product | Affected | Fixed in |
|---|---|---|
| WebDyne for Perl | 2.014 before 3.022 | 3.022 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting. The textfield, password_field and filefield tags fill their value attribute from the request parameter of the same name. WEBDYNE_CGI_AUTOESCAPE, which controls escaping of these values, defaults to off. From 2.022, WebDyne::HTML::Tiny also replaced its entity_encode method with one that returns its input unchanged, so enabling WEBDYNE_CGI_AUTOESCAPE has no effect. A remote attacker can inject script into any page using these tags through a crafted link.
- Weakness
- CWE-79