WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.022
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
WebDyne, a Perl framework for building web pages, is affected in versions before 3.022. Because it treats any file with ".psp" anywhere in its name as a Perl page, an attacker who can upload a file like "report.psp.pdf" could get the server to run the Perl code inside it, potentially allowing arbitrary code execution.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor. An application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- WebDyne
From 2.031 · fixed in 3.022