CVE-2026-118994
Received Received - Intake

Log Injection in CallBackery Perl Versions Before 0.62.0

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: CPANSec

Description
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record. An unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-118994
EUVD
EUVD-2026-113916

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
callbackery callbackery to 0.62.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-117 The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CallBackery versions before 0.62.0 for Perl have a log injection vulnerability due to improper handling of login names. The login() function writes the login name directly to application logs without escaping control characters like newlines. This allows an unauthenticated attacker to inject forged log records by including newlines in the login name.

Detection Guidance

Check application logs for CallBackery instances for entries containing newline characters or unusual formatting in login names. Inspect log files for forged records like fake administrator logins with unexpected source addresses.

Impact Analysis

An attacker could forge log entries to create fake administrator login records from arbitrary IP addresses. This could mislead administrators about system activity, obscure real security events, or be used to cover up malicious actions by manipulating log data.

Mitigation Strategies

Upgrade CallBackery to version 0.62.0 or later. Review and sanitize all login names to remove control characters before logging. Monitor logs for suspicious entries indicating exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118994. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart