Is CVE-2026-78189 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78189 being exploited in the wild.

How severe is CVE-2026-78189?

Informational severity, published 31 October 2026.

How is CVE-2026-78189 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-78189?

Check whether you run ASPEER WebDyne at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78189: WebDyne path traversal in PSGI API route fallback

CVE-2026-78189 · Severity: info · Published 2026-10-31

WebDyne is a Perl web application framework that processes dynamic .psp pages containing embedded Perl code. A path traversal vulnerability in versions 3.007 through 3.021 allows an attacker to execute Perl code in .psp files located outside the intended document root directory, such as files uploaded to restricted locations. This could lead to unauthorized code execution and data exposure on the web server.

Technologies: ASPEER WebDyne. Vendors: ASPEER.

Quick answers

Is CVE-2026-78189 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78189 being exploited in the wild.
How severe is CVE-2026-78189?: Informational severity, published 31 October 2026.
Which products and versions are affected?: ASPEER WebDyne 3.007 to 3.021.
Is there a fix for CVE-2026-78189?: Yes: fixed in WebDyne 3.022. Until then: Disable API routing or restrict access to WebDyne applications until upgraded to version 3.022, which fixes the traversal check by rejecting dot path segments before route discovery and verifying API files remain inside the document root using canonical relative-path validation.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-31"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78189 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-78189?: Check whether you run ASPEER WebDyne at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: WebDyne 3.022

Disable API routing or restrict access to WebDyne applications until upgraded to version 3.022, which fixes the traversal check by rejecting dot path segments before route discovery and verifying API files remain inside the document root using canonical relative-path validation.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-31"}]

Technical details

The PSGI handler's API route fallback retains ".." path segments and performs an incomplete document-root check that allows requests like /../private to bypass validation. An attacker can craft requests using path traversal sequences to reach and execute .psp files outside the document root, gaining arbitrary code execution through the embedded Perl interpreter.

Affected products

ASPEER WebDyne 3.007 to 3.021

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.