WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor.
An application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to WebDyne 3.022 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://metacpan.org/release/ASPEER/WebDyne-3.022/changes |
|
Sat, 31 Oct 2026 15:45:00 +0100
| Type | Values Removed | Values Added |
|---|---|---|
| Description | WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor. An application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it. | |
| Title | WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages | |
| Weaknesses | CWE-777 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-31T14:34:30.167Z
Reserved: 2026-08-23T18:38:50.604Z
Link: CVE-2026-78191
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-31T15:16:54.247
Modified: 2026-10-31T15:16:54.247
Link: CVE-2026-78191
Redhat
No data.
OpenCVE Enrichment
No data.