CVE-2026-78189
Last modified
CVE-2026-78189 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through api_filename. That keeps .. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through api_filename. That keeps .. segments in the request path and only checks that the joined path starts with the document root, which a request for /../private passes. A remote attacker can run the embedded Perl in any .psp file the server can read, such as one uploaded to a directory outside the document root.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| — | — | >= 3.007, < 3.022 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-78189?
How severe is CVE-2026-78189?
How do I fix CVE-2026-78189?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-78182A security vulnerability has been detected in Shenzhen Gongj…7.3
- CVE-2026-78183DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds wri…9.8
- CVE-2026-78185A vulnerability was detected in itsourcecode Sales and Inven…6.3
- CVE-2026-78186A flaw has been found in Open5GS up to 2.8.0. This affects a…4.3
- CVE-2026-78187A vulnerability has been found in Piwigo 16.3.0. This impact…3.1
- CVE-2026-78188WebDyne versions from 2.014 before 3.022 for Perl issue sess…5.4
- CVE-2026-7819Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 F…8.1
- CVE-2026-78190WebDyne versions from 2.014 before 3.022 for Perl reflect re…6.1
- CVE-2026-78191WebDyne versions from 2.031 before 3.022 for Perl execute fi…9.8
- CVE-2026-78192WebDyne versions from 2.022 before 3.022 for Perl disclose a…7.5
- CVE-2026-78193The JTL-Connector for WooCommerce plugin for WordPress is vu…7.5
- CVE-2026-78195Rejected reason: Rejecting as a duplicate of CVE-2026-78047
Are you affected by CVE-2026-78189?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST