CPANSA-WebDyne-2026-78191: WebDyne vulnerability

Publisher giterlizzi Document category csaf_security_advisory
Initial release date 2026-10-31T00:00:00 Engine CSAF Perl Toolkit 0.26
Current release date 2026-10-31T00:00:00 Build Date
Current version 1 Status final
CVSS v3.1 Base Score Severity
Original language Language en
Also referred to

Vulnerability Description

WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages.

WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor.

An application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.

Vulnerabilities

CVE-2026-78191

Vulnerability Description

WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages.

WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor.

An application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.

Weakness CWE-777 : Regular Expression without Anchors

Product status

Known affected
Product Score
WebDyne greater than or equal 2.031 and less than 3.022
CVSS Version CVSS Vector CVSS Base Score CVSS Base Severity
Fixed

giterlizzi

Namespace: https://github.com/giterlizzi/

gdt@cpan.org

References

Revision history

Version Date of the revision Summary of the revision
1 Sat Oct 31 00:00:00 2026 First release

Sharing rules

TLP:WHITE
For the TLP version see: https://www.first.org/tlp/