CVE-2026-78192

    Dashboard / Vulnerabilities / CVE-2026-78192

    CVE-2026-78192

    Published: 31 Oct 2026Last Modified: 8 Nov 2026

    Summary: WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page

    Details: WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page. WebDyne's wrapper scripts, such as webdyne.psgi, enable the built-in index page by default. Its source viewer returns files under the document root named in the source parameter of an HTMX request, including .psp, .pm and .pl files. A remote attacker can read the application's Perl code, including the __PERL__ blocks of .psp pages and any credentials they hold.

    References: https://cpan.org/modules, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78192.json, https://metacpan.org/release/ASPEER/WebDyne-3.022/changes, https://nvd.nist.gov/vuln/detail/CVE-2026-78192, https://github.com/aspeer/WebDyne

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 88b83bed606fd3b12ba5c1a43ed3d640afe2be8e
    Fixed -afb2fdc452ffda3a1bda1f63ef70b4ba52f083a9

    Affected versions

    v3.21.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-78192 | CVE-DB