Cyber ·
WebDyne for Perl: five CVEs covering cookies, path traversal and unescaped reflection
Advisory on five flaws in WebDyne for Perl: session cookies without security attributes, file execution outside the document root and unescaped request parameter reflection. Versions before 3.022 are listed as affected.
The advisory, published on October 31, 2026 on the oss-sec list and signed by Robert Rothenberg, describes five flaws in WebDyne for Perl, including missing cookie attributes, path traversal and unescaped parameter reflection. The available text is an automatic translation and details only three of them.
CVE-2026-78188: versions from 2.014 and earlier than 3.022 issue session cookies without the Secure, HttpOnly and SameSite attributes. CVE-2026-78189: versions from 3.007 and earlier than 3.022 execute .psp files outside the document root through path traversal in the PSGI API route fallback. CVE-2026-78190: versions from 2.014 and earlier than 3.022 reflect unescaped request parameters in form fields.
For anyone using the package, the first step is to check the installed version and plan an upgrade to 3.022, the limit stated in the advisory. The excerpt does not describe the other two flaws in the title, so the original list should be consulted for details and the author's recommendations.
Rota Nacional does not patch third-party libraries or replace server updates. When an application calls the API, the personal data detector applies the organization's policy before any model runs, and raw content stays only in the audit archive encrypted with AES-256-GCM. If someone uses AI to study the advisory, they should not paste cookies, tokens, session logs or customer data into the prompt; synthetic excerpts are preferable.