Code Execution Vulnerability in WebDyne by ASPEER
CVE-2026-78191

Currently unrated

Key Information:

Status
Vendor
CVE Published:
31 October 2026

What is CVE-2026-78191?

The issue in WebDyne arises from improper handling of file extensions for uploaded Perl scripts, allowing remote attackers to execute arbitrary Perl code. Specifically, the application's matching process for file names lacks an end anchor, enabling attackers to craft filenames that deceive the upload system. For instance, a file named 'report.psp.pdf' could be exploited to execute the embedded Perl code when accessed, severely compromising the security of systems using affected versions. Proper validation and restriction on file types are essential to mitigate this vulnerability.

References

https://metacpan.org/release/ASPEER/WebDyne-3.022/changes
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.