{"id":"CVE-2026-78191","title":"WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages","summary":"WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages.\n\nWebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end an…","severity":"none","cwe":["CWE-777"],"product":"WebDyne","affected":["WebDyne >= 2.031 < 3.022"],"published":"2026-10-31","updated":"2026-10-31","sourceUpdated":"2026-10-31T14:34:30.167Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-78191","references":[{"url":"https://metacpan.org/release/ASPEER/WebDyne-3.022/changes"}],"tags":["cve.org"],"epss":0.00454,"epssPercentile":0.39547,"ingestedAt":"2026-11-05T16:24:31.549Z","slug":"CVE-2026-78191","body":"## Overview\n\nWebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages.\n\nWebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor.\n\nAn application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.\n\n## Affected\n\n- `WebDyne >= 2.031 < 3.022`\n\n## Remediation\n\nUpgrade to WebDyne 3.022 or later.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}