WebDyne for Perl: Multiple Vulnerabilities (CVE-2026-78188, CVE-2026-78189, CVE-2026-78190)
WebDyne for Perl is affected by multiple vulnerabilities involving session cookie attributes, path traversal, and unescaped request parameters.
CVE search metadata
CVE search record: CVE-2026-78188. KEV: no. Product: WebDyne for Perl (2.014-3.021). Brief: WebDyne for Perl: Multiple Vulnerabilities (CVE-2026-78188, CVE-2026-78189, CVE-2026-78190). Brief link: https://feed.craftedsignal.io/briefs/2026-10-webdyne-perl-vulnerabilities/
CVE search record: CVE-2026-78189. KEV: no. Product: WebDyne for Perl (2.014-3.021). Brief: WebDyne for Perl: Multiple Vulnerabilities (CVE-2026-78188, CVE-2026-78189, CVE-2026-78190). Brief link: https://feed.craftedsignal.io/briefs/2026-10-webdyne-perl-vulnerabilities/
CVE search record: CVE-2026-78190. KEV: no. Product: WebDyne for Perl (2.014-3.021). Brief: WebDyne for Perl: Multiple Vulnerabilities (CVE-2026-78188, CVE-2026-78189, CVE-2026-78190). Brief link: https://feed.craftedsignal.io/briefs/2026-10-webdyne-perl-vulnerabilities/
Triage facts
Revision 1- Applicability
- WebDyne for Perl (2.014-3.021)
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 31, 19:51 UTC
- Vulnerabilities
- 3 CVEs
- Source quality
- D3Roughly even chance
Robert Rothenberg reported three vulnerabilities in WebDyne for Perl:
- CVE-2026-78188: Versions 2.014 through 3.021 issue session cookies without Secure, HttpOnly, and SameSite attributes.
- CVE-2026-78189: Versions 3.007 through 3.021 allow the execution of .psp files outside the document root via path traversal in the PSGI API route fallback.
- CVE-2026-78190: Versions 2.014 through 3.021 reflect request parameters unescaped into form fields.