CVE-2026-118988

    Dashboard / Vulnerabilities / CVE-2026-118988

    CVE-2026-118988

    Published: 30 Oct 2026Last Modified: 8 Nov 2026

    Summary: CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route

    Details: CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route. Every CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search->find without validation. find splits the name on "::" and joins the parts into a file path, so a name such as "..::..::..::etc::motd" escapes @INC. Any file the server process can read is reachable. Only POD is rendered, but a file with a POD directive and no "=cut" is POD to the end of the file.

    References: http://www.openwall.com/lists/oss-security/2026/10/30/11, https://cpan.org/modules, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118988.json, https://metacpan.org/release/OETIKER/CallBackery-0.60.1/source/CHANGES, https://nvd.nist.gov/vuln/detail/CVE-2026-118988, https://github.com/oetiker/callbackery/commit/128efe804fde41bba9633fe00dc94e30f12087fb.patch, https://github.com/oetiker/callbackery

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -128efe804fde41bba9633fe00dc94e30f12087fb

    Affected versions

    v0.21.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-118988 | CVE-DB