Live › vulnerability › CVE-2026-78191
WebDyne, a Perl web framework, treats any file whose name contains .psp as a Perl page, because its matching pattern has no end anchor. An attacker who can upload a file such as report.psp.pdf can get its embedded Perl code run by requesting it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 15:36 UTC. All times on this page are UTC.
Applications that use WebDyne 2.031 up to but not including 3.022 and accept file uploads that land in a directory WebDyne serves. The exposure depends on the upload check looking only at the final extension, so a file ending in .pdf or .jpg can still be run. Applications with no user uploads, or that serve only static files, are unlikely to be exposed.
No product ranges from the sources yet.
perl -MWebDyne -e 'print $WebDyne::VERSION' or the WebDyne entry in the cpanfile or Makefile.PL.2.031 before 3.022: move to or later.3.022Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages.
WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor.
An application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.
This page as .md · .json · in your agent: get_signal("CVE-2026-78191")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.