{"id":"CVE-2026-78191","aliases":["EUVD-2026-114717","GHSA-xv5f-qcmp-v8w2"],"status":"published","title":"WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages","description":"WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages.\n\nWebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor.\n\nAn application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00474,"percentile":0.41232,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-777"],"published":"2026-10-31T14:34:30Z","modified":"2026-11-06T14:37:02Z","references":[{"url":"https://metacpan.org/release/ASPEER/WebDyne-3.022/changes","tags":["release-notes","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78191","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xv5f-qcmp-v8w2"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78191.json","tags":["advisory"]},{"url":"https://github.com/aspeer/WebDyne","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-78191","title":"WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages","description":"WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages.\n\nWebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor.\n\nAn application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.","status":"published","published":"2026-10-31T14:34:30.167Z","modified":"2026-11-06T14:37:02.412Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-777"],"updated_at":"2026-11-06T15:28:32.799664Z"}],"euvd":[{"id":"EUVD-2026-114717","description":"WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages.\n\nWebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor.\n\nAn application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.","status":"published","published":"2026-10-31T14:34:30Z","modified":"2026-11-06T14:37:02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-06T16:05:20.816071Z"}],"ghsa":[{"id":"GHSA-xv5f-qcmp-v8w2","title":"WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as...","description":"WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages.\n\nWebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor.\n\nAn application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.","status":"published","published":"2026-10-31T15:30:23Z","modified":"2026-11-06T15:32:26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-777"],"updated_at":"2026-11-06T16:00:41.773289Z"}],"nvd":[{"id":"CVE-2026-78191","description":"WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages.\n\nWebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor.\n\nAn application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.","status":"published","published":"2026-10-31T15:16:54.247Z","modified":"2026-11-06T15:17:23.297Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-777"],"updated_at":"2026-11-06T18:00:55.423579Z"}],"osv":[{"id":"CVE-2026-78191","title":"WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages","description":"WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages.\n\nWebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor.\n\nAn application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.","status":"published","published":"2026-10-31T14:34:30.167Z","modified":"2026-11-07T02:48:34.223959268Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-777"],"updated_at":"2026-11-07T03:08:10.640883Z"}]}}