---
id: CVE-2026-78189
title: >-
  WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside
  the document root via path traversal in the PSGI API route fallback
summary: >-
  WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside
  the document root via path traversal in the PSGI API route fallback.


  When a request matches no file, the PSGI handler retries it as an API route
  through api_fi…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-22
product: WebDyne
affected:
  - WebDyne >= 3.007 < 3.022
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-11-06T14:34:31.408384Z'
published: '2026-10-31'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T14:35:24.873Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-78189'
references:
  - url: 'https://metacpan.org/release/ASPEER/WebDyne-3.022/changes'
tags:
  - cve.org
epss: 0.00249
epssPercentile: 0.16322
ingestedAt: '2026-11-05T16:24:31.548Z'
---

## Overview

WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback.

When a request matches no file, the PSGI handler retries it as an API route through api_filename. That keeps .. segments in the request path and only checks that the joined path starts with the document root, which a request for /../private passes.

A remote attacker can run the embedded Perl in any .psp file the server can read, such as one uploaded to a directory outside the document root.

## Affected

- `WebDyne >= 3.007 < 3.022`

## Remediation

Upgrade to WebDyne 3.022 or later.