CVE-2026-118995: falha crítica em CallBackery
CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.3%
CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator.
createRxValidator() is documented to anchor the supplied pattern at both ends, but builds /^${rx}$/ without grouping the pattern. An alternation such as yes|no then accepts any value starting with yes or ending with no, and $ also accepts a value with one trailing newline.
An authenticated user can submit values the pattern was meant to reject, which an application may then write into generated configuration files.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
CallBackeryCVEs relacionadas — CallBackery
No mesmo produto, das mais perigosas para as menos.
CVE-2026-118988HIGHCallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc routeEPSS 0.2%CVE-2026-118992HIGHCallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backupEPSS 0.2%CVE-2026-118994CRITICALCallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login nameEPSS 0.2%CVE-2026-118990MEDIUMCallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backupEPSS 0.2%CVE-2026-118986HIGHCallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()EPSS 0.2%CVE-2026-118987MEDIUMCallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie headerEPSS 0.2%