Live › vulnerability › CVE-2026-78192
WebDyne's default index page includes a source viewer that returns files under the document root, including .psp, .pm and .pl files, when requested by name. An unauthenticated remote attacker can read the application's Perl code, including embedded credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 15:36 UTC. All times on this page are UTC.
Applications running WebDyne for Perl from 2.022 before 3.022 with the default wrapper scripts such as webdyne.psgi, since the built-in index page and its source viewer are enabled by default. Sites that disable the index page or do not expose WebDyne to the network are less exposed; the sources do not say whether a non-default configuration is needed to avoid the index page.
No product ranges from the sources yet.
perl -MWebDyne -e 'print $WebDyne::VERSION'), looking for a version from 2.022 up to but not including 3.022.webdyne.psgi) serves the built-in index page, which is enabled by default.3.022 or later (the affected range is 2.022 before 3.022).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page.
WebDyne's wrapper scripts, such as webdyne.psgi, enable the built-in index page by default. Its source viewer returns files under the document root named in the source parameter of an HTMX request, including .psp, .pm and .pl files.
A remote attacker can read the application's Perl code, including the PERL blocks of .psp pages and any credentials they hold.
This page as .md · .json · in your agent: get_signal("CVE-2026-78192")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.