{"id":"CVE-2026-118992","kind":"vulnerability","aliases":["CVE-2026-118992"],"related":[],"title":"CallBackery for Perl: restored backup runs arbitrary OS commands","description":"CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup.\n\nrestoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code.\n\nAnyone who can supply a backup to be restored can run arbitrary commands as the application user.","summary":"CallBackery versions before 0.62.0 pass the database dump in a configuration backup to the sqlite3 command-line shell during restore. A dump line starting with a dot, such as .shell or .system, runs an operating system command, and .load loads native code.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["callbackery","package","perl","self-hosted"],"not_affected_if":["auth-required","no-backup-restore"],"how_to_check":"- Check the installed CallBackery version; it is affected below `0.62.0`.\n- Look for a restore feature that accepts backup files (restoreConfigBlob) in the deployed application.","fix":"- CallBackery for Perl: `0.62.0`","status":"open","published_at":"2026-10-30T13:18:31+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","triaged_at":"2026-10-30T13:32:27+00:00","updated_at":"2026-10-30T13:32:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T13:32:27Z","model":"claude-haiku-5-5","output":{"fix":"- CallBackery for Perl: `0.62.0`","reach":"unknown","title":"CallBackery for Perl: restored backup runs arbitrary OS commands","impact":"high","summary":"CallBackery versions before 0.62.0 pass the database dump in a configuration backup to the sqlite3 command-line shell during restore. A dump line starting with a dot, such as .shell or .system, runs an operating system command, and .load loads native code.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","callbackery","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Commands run as the application user on the server.","analyst_note":"Confirm whether the restore endpoint requires authentication and the default configuration, using the NVD entry and the CallBackery 0.62.0 release notes.","how_to_check":"- Check the installed CallBackery version; it is affected below `0.62.0`.\n- Look for a restore feature that accepts backup files (restoreConfigBlob) in the deployed application.","plain_action":"","needs_analyst":true,"not_affected_if":["no-backup-restore","auth-required"],"who_is_affected":"Teams running CallBackery for Perl below 0.62.0 that expose the configuration restore function. Anyone who can supply a backup for restore can run commands as the application user. Teams that do not use the restore feature or cannot supply backups to it are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000687,"input_tokens":4179,"output_tokens":539,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118992':12A,15A '-2026':11A,14A '0.62.0':25B,68C 'allow':71C 'anyon':127C 'applic':142C 'arbitrari':7A,138C 'backup':5A,33B,83C,91C,132C 'callbackeri':1A,16B,22B,65C 'code':64B,126C 'command':9A,38B,59B,73C,78C,96C,110C,121C,139C 'command-lin':37B,95C 'configur':32B,82C 'cve':10A,13A 'databas':28B,87C 'dot':49B,106C 'dump':29B,44B,88C,117C 'execut':74C 'feed':85C 'host':21B 'line':39B,45B,97C,102C 'load':61B,62B,123C,124C 'nativ':63B,125C 'oper':57B 'os':8A,72C,120C 'packag':17B 'pass':26B 'perl':3A,18B,70C 'restor':4A,42B,81C,135C 'restoreconfigblob':84C 'run':6A,55B,101C,118C,137C 'self':20B 'self-host':19B 'shell':40B,52B,77C,98C,100C,112C 'sqlite3':36B,76C,94C 'start':46B,103C 'suppli':130C 'system':54B,58B,114C 'user':143C 'version':23B,66C 'via':75C","nicknames":[],"mitigations":[],"who_affected":"Teams running CallBackery for Perl below 0.62.0 that expose the configuration restore function. Anyone who can supply a backup for restore can run commands as the application user. Teams that do not use the restore feature or cannot supply backups to it are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T13:18:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118992","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118992","severity":null,"published_at":"2026-10-30T13:18:31+00:00","modified_at":"2026-10-30T13:18:31+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","fetched_at":"2026-10-30T13:30:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}