Live › vulnerability › CVE-2026-118992
CallBackery versions before 0.62.0 pass the database dump in a configuration backup to the sqlite3 command-line shell during restore. A dump line starting with a dot, such as .shell or .system, runs an operating system command, and .load loads native code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 13:30 UTC. All times on this page are UTC.
Teams running CallBackery for Perl below 0.62.0 that expose the configuration restore function. Anyone who can supply a backup for restore can run commands as the application user. Teams that do not use the restore feature or cannot supply backups to it are less exposed.
No product ranges from the sources yet.
0.62.0.0.62.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup.
restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code.
Anyone who can supply a backup to be restored can run arbitrary commands as the application user.
This page as .md · .json · in your agent: get_signal("CVE-2026-118992")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.