Application Source Disclosure in WebDyne for Perl by ASPEER
CVE-2026-78192

Currently unrated

Key Information:

Status
Vendor
CVE Published:
31 October 2026

What is CVE-2026-78192?

WebDyne versions prior to 3.022 for Perl allow unauthorized users to access application source code through a misconfigured default index page. The vulnerability exploits the viewer functionality of wrapper scripts like webdyne.psgi, which returns files based on user-supplied HTMX requests. Consequently, attackers can gain access to sensitive Perl files, exposing potential credentials and internal logic of the application.

References

https://metacpan.org/release/ASPEER/WebDyne-3.022/changes
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.