# CVE-2026-78189: WebDyne path traversal in PSGI API route fallback

Source: https://junglewise.ai/threats/cve-2026-78189-webdyne-versions-from-3-007-before-3-022-for-perl-execute-psp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-31. Updated: 2026-10-31  
License: CC BY 4.0 with a link back

CVE-2026-78189 · Severity: info · Published 2026-10-31

WebDyne is a Perl web application framework that processes dynamic .psp pages containing embedded Perl code. A path traversal vulnerability in versions 3.007 through 3.021 allows an attacker to execute Perl code in .psp files located outside the intended document root directory, such as files uploaded to restricted locations. This could lead to unauthorized code execution and data exposure on the web server.

Technologies: [ASPEER WebDyne](https://junglewise.ai/threats/technologies/webdyne). Vendors: [ASPEER](https://junglewise.ai/threats/vendors/aspeer).

## Quick answers

**Is CVE-2026-78189 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78189 being exploited in the wild.

**How severe is CVE-2026-78189?** Informational severity, published 31 October 2026.

**Which products and versions are affected?** ASPEER WebDyne 3.007 to 3.021.

**Is there a fix for CVE-2026-78189?** Yes: fixed in WebDyne 3.022. Until then: Disable API routing or restrict access to WebDyne applications until upgraded to version 3.022, which fixes the traversal check by rejecting dot path segments before route discovery and verifying API files remain inside the document root using canonical relative-path validation.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-31"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78189 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-78189?** Check whether you run ASPEER WebDyne at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in WebDyne 3.022

Disable API routing or restrict access to WebDyne applications until upgraded to version 3.022, which fixes the traversal check by rejecting dot path segments before route discovery and verifying API files remain inside the document root using canonical relative-path validation.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-31"}]

## Technical details

The PSGI handler's API route fallback retains ".." path segments and performs an incomplete document-root check that allows requests like /../private to bypass validation. An attacker can craft requests using path traversal sequences to reach and execute .psp files outside the document root, gaining arbitrary code execution through the embedded Perl interpreter.

## Affected products

- ASPEER WebDyne 3.007 to 3.021

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://metacpan.org/release/ASPEER/WebDyne-3.022/changes](https://metacpan.org/release/ASPEER/WebDyne-3.022/changes)

## Related threats

- [WebDyne source code disclosure via default index viewer](https://junglewise.ai/threats/cve-2026-78192-webdyne-versions-from-2-022-before-3-022-for-perl-disclose)
- [WebDyne PSP extension matching regex remote code execution](https://junglewise.ai/threats/cve-2026-78191-webdyne-versions-from-2-031-before-3-022-for-perl-execute-files)
- [WebDyne reflected XSS via unescaped form field values](https://junglewise.ai/threats/cve-2026-78190-webdyne-versions-from-2-014-before-3-022-for-perl-reflect-request)
- [WebDyne session cookie missing Secure, HttpOnly, SameSite attributes](https://junglewise.ai/threats/cve-2026-78188-webdyne-versions-from-2-014-before-3-022-for-perl-issue-session)