Threats affecting pkg:cpan/WebDyne

CVE-2026-78192 is a vulnerability in WebDyne versions from 2.022 up to but not including 3.022 that allows unauthenticated remote attackers to read application source code via the default index page's source viewer. This exposure includes Perl source files and embedded credentials within __PERL__ blocks of .psp pages. The issue arises because WebDyne's wrapper scripts enable the built-in index page by default, which returns files specified by the source parameter in HTMX requests.

WebDyne versions from 2.031 up to but not including 3.022 contain a vulnerability where files with .psp anywhere in their name are executed as Perl pages due to a regular expression lacking an end anchor. This allows an attacker to upload files with names like report.psp.pdf and have them executed as Perl scripts by requesting the file, bypassing simple extension checks.

WebDyne versions from 2.014 up to but not including 3.022 contain a cross-site scripting (XSS) vulnerability. This occurs because certain form tags (textfield, password_field, filefield) reflect request parameters into their value attributes without proper escaping. The default escaping control (WEBDYNE_CGI_AUTOESCAPE) is off, and from version 2.022 the entity encoding method was replaced with a no-op, rendering escaping ineffective. An attacker can inject malicious scripts via crafted links using these tags.

CVE-2026-78189 is a path traversal vulnerability in WebDyne Perl versions from 3.007 up to but not including 3.022. It allows remote attackers to execute .psp files outside the document root by exploiting the PSGI API route fallback mechanism. The vulnerability arises because the PSGI handler does not properly sanitize path segments containing '..', enabling access to files outside the intended directory.

WebDyne versions from 2.014 up to but not including 3.022 for Perl set session cookies without the Secure, HttpOnly, and SameSite attributes. This allows browsers to send session IDs over plain HTTP and with cross-site requests, exposing them to theft by network attackers or malicious scripts. The vulnerability is fixed in version 3.022.