CVE-2026-78191

Full vulnerability record from the local CVENow database.

Description

WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor. An application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

9b29abf9-4ab0-4765-b253-1875cd9b441e

Published

2026-10-31 15:16:54.247000

Last modified

2026-10-31 15:16:54.247000

View original CVE JSON

{
  "id": "CVE-2026-78191",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-10-31T15:16:54.247",
  "lastModified": "2026-10-31T15:16:54.247",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages.\n\nWebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor.\n\nAn application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "WebDyne",
          "modules": [
            "WebDyne"
          ],
          "programFiles": [
            "lib/WebDyne/Constant.pm",
            "lib/WebDyne/Request/PAGI.pm",
            "lib/WebDyne/Request/PSGI.pm"
          ],
          "repo": "https://github.com/aspeer/WebDyne",
          "packageURL": "pkg:cpan/WebDyne",
          "versions": [
            {
              "version": "2.031",
              "lessThan": "3.022",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-777"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://metacpan.org/release/ASPEER/WebDyne-3.022/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ]
}