{"id":"CVE-2026-78191","kind":"vulnerability","aliases":["CVE-2026-78191"],"related":[],"title":"WebDyne: files containing .psp anywhere in name run as Perl","description":"WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages.\n\nWebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor.\n\nAn application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.","summary":"WebDyne, a Perl web framework, treats any file whose name contains .psp as a Perl page, because its matching pattern has no end anchor. An attacker who can upload a file such as report.psp.pdf can get its embedded Perl code run by requesting it.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","perl","self-hosted","webdyne"],"not_affected_if":["no-file-uploads","static-only","webdyne-3.022-or-later"],"how_to_check":"- Check the installed WebDyne version with `perl -MWebDyne -e 'print $WebDyne::VERSION'` or the `WebDyne` entry in the cpanfile or Makefile.PL.\n- Search your application's upload handling for accepted extensions and whether uploaded files are stored where WebDyne serves them.\n- Look for WEBDYNE_PSP_EXT_RE in your WebDyne configuration or overrides.","fix":"- WebDyne versions from `2.031` before `3.022`: move to `3.022` or later.","status":"open","published_at":"2026-10-31T15:16:54+00:00","first_seen_at":"2026-10-31T15:36:19+00:00","triaged_at":"2026-10-31T15:36:40+00:00","updated_at":"2026-10-31T15:36:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T15:36:40Z","model":"claude-haiku-5-5","output":{"fix":"- WebDyne versions from `2.031` before `3.022`: move to `3.022` or later.","reach":"internet","title":"WebDyne: files containing .psp anywhere in name run as Perl","impact":"high","summary":"WebDyne, a Perl web framework, treats any file whose name contains .psp as a Perl page, because its matching pattern has no end anchor. An attacker who can upload a file such as report.psp.pdf can get its embedded Perl code run by requesting it.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","webdyne","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Uploaded file's embedded Perl code runs on the server","analyst_note":"Confirm whether the upload requirement needs authentication and whether NVD's affected range is the only source; no vendor advisory was given.","how_to_check":"- Check the installed WebDyne version with `perl -MWebDyne -e 'print $WebDyne::VERSION'` or the `WebDyne` entry in the cpanfile or Makefile.PL.\n- Search your application's upload handling for accepted extensions and whether uploaded files are stored where WebDyne serves them.\n- Look for WEBDYNE_PSP_EXT_RE in your WebDyne configuration or overrides.","plain_action":"","needs_analyst":true,"not_affected_if":["no-file-uploads","static-only","webdyne-3.022-or-later"],"who_is_affected":"Applications that use WebDyne 2.031 up to but not including 3.022 and accept file uploads that land in a directory WebDyne serves. The exposure depends on the upload check looking only at the final extension, so a file ending in .pdf or .jpg can still be run. Applications with no user uploads, or that serve only static files, are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000757,"input_tokens":4174,"output_tokens":680,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-78191':13A,16A '2.031':69C '3.022':71C 'accept':113C 'anchor':46B,109C 'anywher':5A,78C 'applic':111C 'attack':48B,124C 'check':116C 'code':62B 'contain':3A,33B 'cve':11A,14A 'decid':86C 'embed':60B,134C 'end':45B,108C 'execut':74C 'ext':103C 'extens':120C 'file':2A,30B,53B,75C,92C,127C 'final':119C 'framework':27B 'get':58B 'host':21B 'let':121C 'match':41B,97C 'name':7A,32B,81C,99C 'packag':17B 'page':38B,84C,95C 'pattern':42B 'perl':10A,18B,25B,37B,61B,73C,83C,135C 'psp':4A,34B,77C,102C 're':104C 'remot':123C 'report.psp.pdf':56B,130C 'request':65B,91C,137C 'run':8A,63B,89C,132C 'self':20B 'self-host':19B 'treat':28B 'upload':51B,114C,125C 'version':67C 'web':26B 'webdyn':1A,22B,23B,66C,85C,101C 'whether':87C 'whose':31B","nicknames":[],"mitigations":[],"who_affected":"Applications that use WebDyne 2.031 up to but not including 3.022 and accept file uploads that land in a directory WebDyne serves. The exposure depends on the upload check looking only at the final extension, so a file ending in .pdf or .jpg can still be run. Applications with no user uploads, or that serve only static files, are unlikely to be exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-31T15:16:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-78191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78191","severity":null,"published_at":"2026-10-31T15:16:54+00:00","modified_at":"2026-10-31T15:16:54+00:00","first_seen_at":"2026-10-31T15:36:19+00:00","fetched_at":"2026-10-31T15:36:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}