CVE-2026-78192 PUBLISHED

WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page

Assigner: CPANSec
Reserved: 23.08.2026 Published: 31.10.2026 Updated: 31.10.2026

WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page.

WebDyne's wrapper scripts, such as webdyne.psgi, enable the built-in index page by default. Its source viewer returns files under the document root named in the source parameter of an HTMX request, including .psp, .pm and .pl files.

A remote attacker can read the application's Perl code, including the PERL blocks of .psp pages and any credentials they hold.

Product Status

Package Collection https://cpan.org/modules
Package Name WebDyne
Versions Default: unaffected
  • affected from 2.022 to 3.022 (excl.)

Solutions

Upgrade to WebDyne 3.022 or later.

References

Problem Types

  • CWE-540 Inclusion of Sensitive Information in Source Code CWE
  • CWE-1188 Initialization of a Resource with an Insecure Default CWE