CVE-2026-118988
Received Received - Intake

Path Traversal in CallBackery Documentation Plugin

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: CPANSec

Description
CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route. Every CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search->find without validation. find splits the name on "::" and joins the parts into a file path, so a name such as "..::..::..::etc::motd" escapes @INC. Any file the server process can read is reachable. Only POD is rendered, but a file with a POD directive and no "=cut" is POD to the end of the file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-118988
EUVD
EUVD-2026-113903

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
callbackery callbackery to 0.60.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in CallBackery versions before 0.60.1 for Perl. It allows unauthenticated users to read any file on the server by exploiting the /doc route. The route accepts a document name that is passed to Pod::Simple::Search->find without validation. By crafting a name with '::' separators like '..::..::..::etc::motd', an attacker can escape the intended directory and access any readable file, including sensitive files.

Detection Guidance

Check if your CallBackery application is running a version before 0.60.1 by inspecting the installed version via package manager or application logs. Test for path traversal by attempting to access files outside expected directories using crafted URLs like /doc/..::..::..::etc::motd to see if sensitive files are exposed.

Impact Analysis

This vulnerability can allow attackers to read sensitive files on the server, such as configuration files, logs, or other confidential data. Since it bypasses authentication and operates within a single URL segment, it may evade detection by security tools. The impact includes potential data breaches, unauthorized access to system information, and compromise of application integrity.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations by exposing sensitive personal or health data. Unauthorized access to files may result in data breaches, violating privacy requirements and leading to legal penalties, fines, or reputational damage for organizations handling regulated data.

Mitigation Strategies

Upgrade CallBackery to version 0.60.1 or later immediately. If upgrading is not possible, restrict access to the /doc route via firewall or reverse proxy rules. Validate all document names in the application to ensure they match a plain module name pattern before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118988. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart