WebDyne versions from 3.007 up to but not including 3.022 for Perl contain a path traversal vulnerability in the PSGI API route fallback. This flaw allows remote attackers to execute .psp files located outside the document root by exploiting insufficient path validation. The PSGI handler retries unmatched requests as API routes without properly sanitizing '..' segments, enabling access to files outside the intended directory.