CVE-2026-78189

WebDyne versions from 3.007 before 3.022 are vulnerable to a path traversal vulnerability in the PSGI API route fallback . When a request matches no file, the PSGI handler retries it as an API route via api_filename, which preserves .. segments in the request path. Because the system only verifie...