Live › vulnerability › CVE-2026-118990
CallBackery before 0.62.0 writes a dump of its configuration database, including every user's password hash, to a predictable file in /tmp and never deletes it. A local user can read that dump, or plant a symlink so the dump overwrites a file they choose.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 13:30 UTC. All times on this page are UTC.
Hosts running CallBackery before 0.62.0 where a local user can log in or run code and where configuration backups have been taken. The dump is written by getConfigBlob() on backup, so installations that never back up configuration are not exposed through this path. Multi-user hosts are the main concern; single-user machines with no other local accounts carry much less risk.
No product ranges from the sources yet.
perl -MCallBackery -e 'print $CallBackery::VERSION'), unknown if the sources do not give the exact command/tmp/cbdump* on hosts where CallBackery has run configuration backups0.62.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup.
getConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump<pid> and never removes it. The file takes the process umask, and a symlink planted at that predictable name is followed.
The dump holds every user's password hash and every value saved by the application's forms. A local user can read these after any backup, and may redirect the dump to a file of their choosing.
This page as .md · .json · in your agent: get_signal("CVE-2026-118990")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.