CVE-2026-118990
Received Received - Intake

Information Disclosure in CallBackery for Perl

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: CPANSec

Description
CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump<pid> and never removes it. The file takes the process umask, and a symlink planted at that predictable name is followed. The dump holds every user's password hash and every value saved by the application's forms. A local user can read these after any backup, and may redirect the dump to a file of their choosing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-118990
EUVD
EUVD-2026-113920

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
callbackery callbackery to 0.62.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-379 The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CallBackery versions before 0.62.0 for Perl have a flaw where configuration backups create a world-readable file in /tmp. The function getConfigBlob() writes a database dump to a predictable filename like /tmp/cbdump<pid> without removing it afterward. The file inherits the process umask, and attackers can exploit a symlink to read sensitive data or redirect the dump to another location.

Detection Guidance

Check for world-readable dump files in /tmp with names matching /tmp/cbdump<pid>. Use commands like 'ls -l /tmp/cbdump*' or 'find /tmp -name 'cbdump*' -perm -o=r' to locate them.

Impact Analysis

A local attacker could read the backup file containing all user password hashes and application form data. They might also manipulate the symlink to redirect the dump to a file they control, potentially stealing credentials or sensitive information stored in the application.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if protected health information was exposed. It breaches confidentiality requirements by allowing local users to access sensitive data without authorization.

Mitigation Strategies

Upgrade CallBackery to version 0.62.0 or later to fix the issue. Remove any existing dump files in /tmp and ensure no symlinks point to them. Review file permissions in /tmp.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118990. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart