CVE-2026-118988
Severity not reportedCallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route.
CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route. Every CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search->find without validation. find splits the name on "::" and joins the parts into a file path, so a name such as "..::..::..::etc::motd" escapes @INC. Any file the server process can read is reachable. Only POD is rendered, but a file with a POD directive and no "=cut" is POD to the end of the file.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/oetiker/callbackery/commit/128efe804fde41bba9633fe00dc94e30f12087fb.pat... 9b29abf9-4ab0-4765-b253-1875cd9b441e
- https://metacpan.org/release/OETIKER/CallBackery-0.60.1/source/CHANGES 9b29abf9-4ab0-4765-b253-1875cd9b441e
- http://www.openwall.com/lists/oss-security/2026/10/30/11 af854a3a-2127-422b-91ae-364da2661108