CVE-2026-118992
Received Received - Intake

OS Command Injection in CallBackery Perl

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: CPANSec

Description
CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code. Anyone who can supply a backup to be restored can run arbitrary commands as the application user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-118992
EUVD
EUVD-2026-113918

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
callbackery callbackery to 0.62.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CallBackery versions before 0.62.0 for Perl have a vulnerability that allows OS command execution. The restoreConfigBlob() function processes database dumps from backups using the sqlite3 command-line shell. Malicious backup files can include sqlite3 shell commands like .shell, .system, or .load to execute arbitrary operating system commands as the application user.

Detection Guidance

Check if CallBackery versions before 0.62.0 for Perl are installed by running: perl -MCallBackery -e 'print $CallBackery::VERSION' | grep -v 0.62.0. Inspect backup files for .shell, .system, or .load commands in sqlite3 dumps using: grep -E '(\.shell|\.system|\.load)' backup_file.sql.

Impact Analysis

If you can supply a backup file to be restored by CallBackery, an attacker could execute arbitrary commands on the system running the application. This could lead to unauthorized access, data theft, system compromise, or further network infiltration depending on the permissions of the application user.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Organizations could face legal penalties, reputational damage, and loss of trust if such incidents occur due to this flaw.

Mitigation Strategies

Upgrade CallBackery to version 0.62.0 or later. Restrict access to backup files to prevent unauthorized restoration. Review and sanitize backup files before restoration to remove any .shell, .system, or .load commands.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118992. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart