WebDyne for Perl has five CVEs including cookie and path traversal issues
Original title: WebDyne for Perl (5 CVEs)
WebDyne versions 2.014-3.022 for Perl issue insecure session cookies and allow path traversal in PSGI API.
WebDyne for Perl has five CVEs. CVE-2026-78188 affects versions 2.014-3.022 and omits Secure, HttpOnly and SameSite on session cookies. CVE-2026-78189 allows execution of .psp files outside document root via path traversal in PSGI API route fallback. CVE-2026-78190 reflects request parameters unescaped into form fields.
- CVE-2026-78188: missing Secure/HttpOnly/SameSite on cookies
- CVE-2026-78189: path traversal in PSGI API
- CVE-2026-78190: unescaped parameter reflection
- Affected: versions 2.014 to 3.022 for Perl
Impact: session hijacking
| Product | Affected | Fixed in |
|---|---|---|
| WebDyne | 2.014 before 3.022 for Perl | 3.022 |
- Vendors
- WebDyne
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-78188 | Missing secure flags in WebDyne Perl session cookies before 3.022 | — | — | ||
| CVE-2026-78189 | Path traversal RCE in WebDyne Perl before 3.022 | — | — | ||
| CVE-2026-78190 | XSS in WebDyne for Perl before 3.022 | — | — |
From the original article
Posted by Robert Rothenberg on Oct 31 CVE-2026-78188 WebDyne versions from 2. 014 before 3. 022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes CVE-2026-78189 WebDyne versions from 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.