The vulnerability lies in WebDyne's default index page, where the source viewer exposes files under the document root via a source parameter in an HTMX request. This allows an unauthenticated client to retrieve the Perl application code, including embedded Perl blocks and any embedded credentials. The result is full source disclosure, which can reveal business logic, configuration, and sensitive data, potentially leading to further exploitation.

WebDyne versions starting from 2.022 through, but not including, 3.022 for Perl. Affected deployments that include the webdyne.psgi wrapper script, which is shipped with these releases and serves the default index page with the source viewer enabled.

The vulnerability can be triggered by a simple HTTP request to the default index page with an HTMX source parameter pointing to any file under the document root, such as .psp, .pm, or .pl files. No authentication is required, and no complex prerequisites or user interaction are needed. Because the flaw allows reading of arbitrary source files, it can expose credentials and other secrets. EPSS information is not provided, and the flaw is not listed in the CISA KEV catalog. No CVSS score is reported in the supplied data, but the severity implied by complete source disclosure would be considered high.