Answer in brief
CVE-2026-78189 records a Unknown severity vulnerability in WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. The current sources do not mark it as known exploited. The current feed maps WebDyne (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps WebDyne (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| WebDynegeneric | >=3.007 <3.022 | 3.022 |
Published upstream
Oct 31, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 31, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 31, 2026
WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through api_filename. That keeps .. segments in the request path and only checks that the joined path starts with the document root, which a request for /../private passes. A remote attacker can run the embedded Perl in any .psp file the server can read, such as one uploaded to a directory outside the document root.
Quoted source text, attributed separately from HOL analysis.