CVE-2026-118994: critical vulnerability in CallBackery
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 0.2%
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name.
login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record.
An unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
CallBackeryRelated CVEs — CallBackery
In the same product, most dangerous first.
CVE-2026-118995CRITICALCallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidatorEPSS 0.3%CVE-2026-118988HIGHCallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc routeEPSS 0.2%CVE-2026-118992HIGHCallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backupEPSS 0.2%CVE-2026-118990MEDIUMCallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backupEPSS 0.2%CVE-2026-118986HIGHCallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()EPSS 0.2%CVE-2026-118987MEDIUMCallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie headerEPSS 0.2%