CVE-2026-78192

HighCVSS 7.5/10Last modified Nov 6, 2026

Description

WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page.

WebDyne's wrapper scripts, such as webdyne.psgi, enable the built-in index page by default. Its source viewer returns files under the document root named in the source parameter of an HTMX request, including .psp, .pm and .pl files.

A remote attacker can read the application's Perl code, including the __PERL__ blocks of .psp pages and any credentials they hold.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-540 CWE-1188

Affected software

Vendor	Product	Versions
—	—	>= 2.022, < 3.022

References

https://metacpan.org/release/ASPEER/WebDyne-3.022/changes

Timeline

Published: Oct 31, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-781937.5The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all CVE-2026-781964.4A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShare CVE-2026-781977.3A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code of the file CVE-2026-781987.3A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown process CVE-2026-781997.3A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/view CVE-2026-78206.5Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4. pgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custo CVE-2026-782006.3A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. CVE-2026-782017.3A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file admin_class.php. T CVE-2026-782027.3A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manip CVE-2026-782037.1Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scop CVE-2026-782045.4Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test_fu CVE-2026-782055.8BentoML's outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses