Vulnerability · Published Oct 31, 2026 · Assigned by CPANSec
CVE-2026-78191WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages
Unrated
In plain English
A security flaw in WebDyne. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS )–Not rated
Exploit odds (30 days)0.5%top 60.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor. An application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WebDyne | 2.031 – before 3.022 |
Weakness: CWE-777