Live › vulnerability › CVE-2026-118988
CallBackery versions before 0.60.1 for Perl let unauthenticated clients use the /doc route to read files via path traversal. An attacker can read any file the server process can read, such as configuration or secrets, when those files contain POD text.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 13:30 UTC. All times on this page are UTC.
Every CallBackery application mounts the documentation plugin at /doc ahead of any session check, so any reachable instance is exposed. The attacker needs no account, and only files the server process can read are exposed, with only POD rendered. Teams not running CallBackery can skip it.
No product ranges from the sources yet.
0.60.1 are affected./doc route (documentation plugin mounted ahead of session checks).0.60.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route.
Every CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search->find without validation. find splits the name on "::" and joins the parts into a file path, so a name such as "..::..::..::etc::motd" escapes @INC.
Any file the server process can read is reachable. Only POD is rendered, but a file with a POD directive and no "=cut" is POD to the end of the file.
This page as .md · .json · in your agent: get_signal("CVE-2026-118988")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.