{"id":"CVE-2026-118990","kind":"vulnerability","aliases":["CVE-2026-118990"],"related":[],"title":"CallBackery (Perl): config backup leaves world-readable database dump in /tmp","description":"CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup.\n\ngetConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump<pid> and never removes it. The file takes the process umask, and a symlink planted at that predictable name is followed.\n\nThe dump holds every user's password hash and every value saved by the application's forms. A local user can read these after any backup, and may redirect the dump to a file of their choosing.","summary":"CallBackery before 0.62.0 writes a dump of its configuration database, including every user's password hash, to a predictable file in /tmp and never deletes it. A local user can read that dump, or plant a symlink so the dump overwrites a file they choose.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["callbackery","package","perl","self-hosted"],"not_affected_if":["no-config-backup","single-user-host","version-0.62.0-or-later"],"how_to_check":"- Check the installed CallBackery version against the Perl module metadata (`perl -MCallBackery -e 'print $CallBackery::VERSION'`), unknown if the sources do not give the exact command\n- Look for leftover files named `/tmp/cbdump*` on hosts where CallBackery has run configuration backups","fix":"- Move to CallBackery `0.62.0` or later","status":"open","published_at":"2026-10-30T13:18:31+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","triaged_at":"2026-10-30T13:32:27+00:00","updated_at":"2026-10-30T13:32:27+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T13:32:27Z","model":"claude-haiku-5-5","output":{"fix":"- Move to CallBackery `0.62.0` or later","reach":"local","title":"CallBackery (Perl): config backup leaves world-readable database dump in /tmp","impact":"medium","summary":"CallBackery before 0.62.0 writes a dump of its configuration database, including every user's password hash, to a predictable file in /tmp and never deletes it. A local user can read that dump, or plant a symlink so the dump overwrites a file they choose.","audience":"businesses","category":"package","nicknames":[],"who_cares":["perl","callbackery","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"local user reads password hashes and form data from /tmp","analyst_note":"","how_to_check":"- Check the installed CallBackery version against the Perl module metadata (`perl -MCallBackery -e 'print $CallBackery::VERSION'`), unknown if the sources do not give the exact command\n- Look for leftover files named `/tmp/cbdump*` on hosts where CallBackery has run configuration backups","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.62.0-or-later","no-config-backup","single-user-host"],"who_is_affected":"Hosts running CallBackery before 0.62.0 where a local user can log in or run code and where configuration backups have been taken. The dump is written by getConfigBlob() on backup, so installations that never back up configuration are not exposed through this path. Multi-user hosts are the main concern; single-user machines with no other local accounts carry much less risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4191,"output_tokens":576,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118990':15A,18A '-2026':14A,17A '/tmp':12A,46B,87C '/tmp/cbdump':102C '0.62.0':27B,73C 'applic':137C 'backup':4A,92C,148C 'callbackeri':1A,19B,25B,70C 'choos':69B,159C 'config':3A 'configur':33B,84C,91C 'cve':13A,16A 'databas':9A,34B,85C 'delet':49B 'dump':10A,30B,57B,64B,81C,100C,124C,153C 'everi':36B,126C,132C 'file':44B,67B,108C,156C 'follow':122C 'form':139C 'getconfigblob':93C 'hash':40B,130C 'hold':125C 'host':24B 'includ':35B 'leav':5A,76C 'local':52B,141C 'may':150C 'name':120C 'never':48B,104C 'overwrit':65B 'packag':20B 'password':39B,129C 'perl':2A,21B,75C 'plant':59B,116C 'predict':43B,119C 'process':111C 'read':55B,144C 'readabl':8A,80C 'redirect':151C 'remov':105C 'save':134C 'self':23B 'self-host':22B 'shell':97C 'sqlite3':96C 'symlink':61B,115C 'take':89C,109C 'umask':112C 'user':37B,53B,127C,142C 'valu':133C 'version':71C 'world':7A,79C 'world-read':6A,78C 'write':28B,98C","nicknames":[],"mitigations":[],"who_affected":"Hosts running CallBackery before 0.62.0 where a local user can log in or run code and where configuration backups have been taken. The dump is written by getConfigBlob() on backup, so installations that never back up configuration are not exposed through this path. Multi-user hosts are the main concern; single-user machines with no other local accounts carry much less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T13:18:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118990","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118990","severity":null,"published_at":"2026-10-30T13:18:31+00:00","modified_at":"2026-10-30T13:18:31+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","fetched_at":"2026-10-30T13:30:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}