CVE-2026-78192
Received Received - Intake

Information Disclosure in WebDyne Perl Application

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: CPANSec

Description
WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page. WebDyne's wrapper scripts, such as webdyne.psgi, enable the built-in index page by default. Its source viewer returns files under the document root named in the source parameter of an HTMX request, including .psp, .pm and .pl files. A remote attacker can read the application's Perl code, including the __PERL__ blocks of .psp pages and any credentials they hold.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-78192
EUVD
EUVD-2026-114718

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
webdyne webdyne to 3.022 (exc)
webdyne webdyne From 2.022 (inc) to 3.022 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-540 Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects WebDyne versions from 2.022 before 3.022 for Perl. It allows unauthenticated users to view application source code through the default index page viewer. The source parameter in HTMX requests can be manipulated to return files like .psp, .pm, and .pl from the document root. This includes Perl code and credentials stored in __PERL__ blocks of .psp pages.

Detection Guidance

Check if WebDyne versions from 2.022 before 3.022 are running by inspecting server configurations or package versions. Test if the source parameter in HTMX requests exposes files by attempting to access .psp, .pm, or .pl files via the viewer. Look for unauthenticated access to application source code.

Impact Analysis

An attacker could exploit this to read sensitive application code and credentials, leading to unauthorized access, data breaches, or further system compromise. This includes internal logic, database credentials, and other confidential information stored in the application.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations by exposing sensitive data such as personal or health information. Unauthorized access to source code and credentials may violate data protection requirements and result in legal penalties.

Mitigation Strategies

Upgrade WebDyne to version 3.022 or later. Disable the default index page viewer in wrapper scripts like webdyne.psgi. Restrict access to sensitive files by configuring proper permissions and authentication for document roots.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78192. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart