unscored
CVE-2026-78191
WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages.
Impact
WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor. An application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.
Affected products
| Product | Affected versions |
|---|---|
| WebDyne Versions From 2.031 | before 3.022 |
Versions were read from the advisory text. No structured product data has been published for this record yet.