Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-78189— WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback

Quick assessment

Affected
CVE-2026-78189
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 版本的 WebDyne 从 3.007 到 3.022（不含 3.022）存在路径遍历漏洞，允许攻击者通过 PSGI API 路由的后备机制执行文档根目录之外的 .psp 文件。 当请求未匹配到任何文件时，PSGI 处理器会通过 将该请求作为 API 路由重新处理。此过程中，请求路径中的 段会被保留，系统仅验证拼接后的路径是否以文档根目录开头。然而，类似 的请求能够绕过该检查。 远程攻击者因此可以执行服务器可读取的任意 .psp 文件中的嵌入式 Perl 代码，例如上传至文档根目录外目录的文件。

AI Predicted 9.8 Difficulty: Easy

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None 3.007< 3.022 affected

I. Basic Information for CVE-2026-78189

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback
Source: CVE Program / CVE List V5
Vulnerability Description
WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through api_filename. That keeps .. segments in the request path and only checks that the joined path starts with the document root, which a request for /../private passes. A remote attacker can run the embedded Perl in any .psp file the server can read, such as one uploaded to a directory outside the document root.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 3.007 ~ 3.022 -

II. Public POCs for CVE-2026-78189

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-78189

请登录查看更多情报信息。

Other References for CVE-2026-78189 (1)

IV. Related Vulnerabilities

Same weakness: CWE-22