WebDyne versions from 2.031 up to but not including 3.022 for Perl execute files with .psp anywhere in the filename as Perl pages. This behavior allows an attacker to upload files with names like report.psp.pdf and have them executed as Perl code by the server.