CVE-2026-78189

{"id": "CVE-2026-78189", "cveTags": [], "metrics": {}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/aspeer/WebDyne", "modules": ["WebDyne"], "versions": [{"status": "affected", "version": "3.007", "lessThan": "3.022", "versionType": "custom"}], "packageURL": "pkg:cpan/WebDyne", "packageName": "WebDyne", "programFiles": ["lib/WebDyne/PSGI.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "WebDyne::PSGI::api_filename"}]}]}], "published": "2026-10-31T15:16:54.003", "references": [{"url": "https://metacpan.org/release/ASPEER/WebDyne-3.022/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback.\n\nWhen a request matches no file, the PSGI handler retries it as an API route through api_filename. That keeps .. segments in the request path and only checks that the joined path starts with the document root, which a request for /../private passes.\n\nA remote attacker can run the embedded Perl in any .psp file the server can read, such as one uploaded to a directory outside the document root."}], "lastModified": "2026-10-31T15:16:54.003", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}