{"id":"CVE-2026-118988","kind":"vulnerability","aliases":["CVE-2026-118988"],"related":[],"title":"CallBackery Perl: unauthenticated path traversal reads arbitrary server files","description":"CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route.\n\nEvery CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search->find without validation. find splits the name on \"::\" and joins the parts into a file path, so a name such as \"..::..::..::etc::motd\" escapes @INC.\n\nAny file the server process can read is reachable. Only POD is rendered, but a file with a POD directive and no \"=cut\" is POD to the end of the file.","summary":"CallBackery versions before 0.60.1 for Perl let unauthenticated clients use the /doc route to read files via path traversal. An attacker can read any file the server process can read, such as configuration or secrets, when those files contain POD text.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["callbackery","package","perl","self-hosted"],"not_affected_if":["version-0.60.1-or-later"],"how_to_check":"- Check the installed CallBackery version; the sources say versions before `0.60.1` are affected.\n- Confirm whether the application exposes the `/doc` route (documentation plugin mounted ahead of session checks).","fix":"- Move CallBackery to version `0.60.1` or later.","status":"open","published_at":"2026-10-30T13:18:31+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","triaged_at":"2026-10-30T13:32:29+00:00","updated_at":"2026-10-30T13:32:29+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T13:32:29Z","model":"claude-haiku-5-5","output":{"fix":"- Move CallBackery to version `0.60.1` or later.","reach":"internet","title":"CallBackery Perl: unauthenticated path traversal reads arbitrary server files","impact":"medium","summary":"CallBackery versions before 0.60.1 for Perl let unauthenticated clients use the /doc route to read files via path traversal. An attacker can read any file the server process can read, such as configuration or secrets, when those files contain POD text.","audience":"businesses","category":"package","nicknames":[],"who_cares":["perl","callbackery","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Server files readable by the process, possibly including secrets","analyst_note":"Check the NVD record and the upstream CallBackery advisory for confirmed exploitation, the exact affected range and any workaround for /doc.","how_to_check":"- Check the installed CallBackery version; the sources say versions before `0.60.1` are affected.\n- Confirm whether the application exposes the `/doc` route (documentation plugin mounted ahead of session checks).","plain_action":"","needs_analyst":true,"not_affected_if":["version-0.60.1-or-later"],"who_is_affected":"Every CallBackery application mounts the documentation plugin at /doc ahead of any session check, so any reachable instance is exposed. The attacker needs no account, and only files the server process can read are exposed, with only POD rendered. Teams not running CallBackery can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000696,"input_tokens":4219,"output_tokens":549,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118988':12A,15A '-2026':11A,14A '/doc':33B,83C,93C '0.60.1':25B,66C 'ahead':94C 'applic':87C 'arbitrari':7A 'attack':42B 'callbackeri':1A,16B,22B,63C,86C 'check':98C 'client':30B,71C 'configur':54B 'contain':60B 'cut':156C 'cve':10A,13A 'direct':153C 'document':90C 'end':161C 'escap':132C 'etc':130C 'everi':85C 'file':9A,37B,46B,59B,77C,123C,135C,149C,164C 'find':109C,112C 'host':21B 'inc':133C 'join':118C 'let':28B,69C 'motd':131C 'mount':88C 'name':104C,115C,127C 'packag':17B 'part':120C 'pass':101C 'path':4A,39B,79C,124C 'perl':2A,18B,27B,68C 'plugin':91C 'pod':61B,74C,106C,144C,152C,158C 'process':49B,138C 'reachabl':142C 'read':6A,36B,44B,51B,72C,140C 'render':146C 'request':103C 'rout':34B,84C,100C 'search':108C 'secret':56B 'self':20B 'self-host':19B 'server':8A,48B,137C 'session':97C 'simpl':107C 'split':113C 'text':62B 'travers':5A,40B,80C 'unauthent':3A,29B,70C 'use':31B 'valid':111C 'version':23B,64C 'via':38B,78C 'without':110C","nicknames":[],"mitigations":[],"who_affected":"Every CallBackery application mounts the documentation plugin at /doc ahead of any session check, so any reachable instance is exposed. The attacker needs no account, and only files the server process can read are exposed, with only POD rendered. Teams not running CallBackery can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T13:18:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118988","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118988","severity":null,"published_at":"2026-10-30T13:18:31+00:00","modified_at":"2026-10-30T13:18:31+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","fetched_at":"2026-10-30T13:30:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}