CVE-2026-118995: fallo crítico en CallBackery
CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.1epss 0.3%
CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator.
createRxValidator() is documented to anchor the supplied pattern at both ends, but builds /^${rx}$/ without grouping the pattern. An alternation such as yes|no then accepts any value starting with yes or ending with no, and $ also accepts a value with one trailing newline.
An authenticated user can submit values the pattern was meant to reject, which an application may then write into generated configuration files.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
CallBackeryCVEs relacionadas — CallBackery
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-118988HIGHCallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc routeEPSS 0.2%CVE-2026-118992HIGHCallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backupEPSS 0.2%CVE-2026-118994CRITICALCallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login nameEPSS 0.2%CVE-2026-118990MEDIUMCallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backupEPSS 0.2%CVE-2026-118986HIGHCallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()EPSS 0.2%CVE-2026-118987MEDIUMCallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie headerEPSS 0.2%