{"id":"CVE-2026-78192","kind":"vulnerability","aliases":["CVE-2026-78192"],"related":[],"title":"WebDyne Perl: default index page leaks application source code to anyone","description":"WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page.\n\nWebDyne's wrapper scripts, such as webdyne.psgi, enable the built-in index page by default. Its source viewer returns files under the document root named in the source parameter of an HTMX request, including .psp, .pm and .pl files.\n\nA remote attacker can read the application's Perl code, including the __PERL__ blocks of .psp pages and any credentials they hold.","summary":"WebDyne's default index page includes a source viewer that returns files under the document root, including .psp, .pm and .pl files, when requested by name. An unauthenticated remote attacker can read the application's Perl code, including embedded credentials.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","perl","self-hosted","webdyne"],"not_affected_if":["default-config-changed"],"how_to_check":"- Check the WebDyne version installed with the Perl module (`perl -MWebDyne -e 'print $WebDyne::VERSION'`), looking for a version from 2.022 up to but not including 3.022.\n- Check whether the wrapper script (such as `webdyne.psgi`) serves the built-in index page, which is enabled by default.","fix":"- WebDyne `3.022` or later (the affected range is 2.022 before 3.022).","status":"open","published_at":"2026-10-31T15:16:54+00:00","first_seen_at":"2026-10-31T15:36:19+00:00","triaged_at":"2026-10-31T15:36:39+00:00","updated_at":"2026-10-31T15:36:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T15:36:39Z","model":"claude-haiku-5-5","output":{"fix":"- WebDyne `3.022` or later (the affected range is 2.022 before 3.022).","reach":"internet","title":"WebDyne Perl: default index page leaks application source code to anyone","impact":"high","summary":"WebDyne's default index page includes a source viewer that returns files under the document root, including .psp, .pm and .pl files, when requested by name. An unauthenticated remote attacker can read the application's Perl code, including embedded credentials.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","webdyne","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Application Perl source and embedded credentials readable by anyone","analyst_note":"","how_to_check":"- Check the WebDyne version installed with the Perl module (`perl -MWebDyne -e 'print $WebDyne::VERSION'`), looking for a version from 2.022 up to but not including 3.022.\n- Check whether the wrapper script (such as `webdyne.psgi`) serves the built-in index page, which is enabled by default.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config-changed"],"who_is_affected":"Applications running WebDyne for Perl from 2.022 before 3.022 with the default wrapper scripts such as webdyne.psgi, since the built-in index page and its source viewer are enabled by default. Sites that disable the index page or do not expose WebDyne to the network are less exposed; the sources do not say whether a non-default configuration is needed to avoid the index page.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000707,"input_tokens":4190,"output_tokens":576,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-78192':14A,17A '2.022':67C '3.022':69C 'anyon':11A 'applic':7A,57B,73C,132C 'attack':53B,128C 'block':139C 'built':96C 'built-in':95C 'client':77C 'code':9A,60B,135C 'credenti':63B,145C 'cve':12A,15A 'default':3A,26B,83C,101C 'disclos':72C 'document':38B,109C 'embed':62B 'enabl':93C 'file':35B,45B,106C,125C 'hold':147C 'host':22B 'htmx':118C 'includ':29B,40B,61B,120C,136C 'index':4A,27B,84C,98C 'leak':6A 'name':49B,111C 'packag':18B 'page':5A,28B,85C,99C,142C 'paramet':115C 'perl':2A,19B,59B,71C,134C,138C 'pl':44B,124C 'pm':42B,122C 'psp':41B,121C,141C 'read':55B,130C 'remot':52B,127C 'request':47B,119C 'return':34B,105C 'root':39B,110C 'script':89C 'self':21B 'self-host':20B 'sourc':8A,31B,74C,103C,114C 'unauthent':51B,76C 'version':65C 'via':78C 'viewer':32B,80C,104C 'webdyn':1A,23B,24B,64C,86C 'webdyne.psgi':92C 'wrapper':88C","nicknames":[],"mitigations":[],"who_affected":"Applications running WebDyne for Perl from 2.022 before 3.022 with the default wrapper scripts such as webdyne.psgi, since the built-in index page and its source viewer are enabled by default. Sites that disable the index page or do not expose WebDyne to the network are less exposed; the sources do not say whether a non-default configuration is needed to avoid the index page.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-31T15:16:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-78192","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78192","severity":null,"published_at":"2026-10-31T15:16:54+00:00","modified_at":"2026-10-31T15:16:54+00:00","first_seen_at":"2026-10-31T15:36:19+00:00","fetched_at":"2026-10-31T15:36:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}