{"id":"CVE-2026-118988","aliases":[],"cve":{"records":[{"id":"CVE-2026-118988","source":"CPANSec","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-29T10:48:23.002Z","published":"2026-10-30T12:34:35.614Z","modified":"2026-10-30T15:05:29.332Z"}],"publishers":[{"name":"CPANSec","role":"CNA","organizationId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","modified":"2026-10-30T12:34:35.614Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-10-30T15:05:29.332Z"}],"references":[{"url":"https://metacpan.org/release/OETIKER/CallBackery-0.60.1/source/CHANGES","tags":["release-notes"],"source":"CPANSec"},{"url":"https://github.com/oetiker/callbackery/commit/128efe804fde41bba9633fe00dc94e30f12087fb.patch","tags":["patch"],"source":"CPANSec"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/11","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","source":"CPANSec"}],"applicability":[],"prioritization":[]},"title":"CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route","titleSource":"CPANSec","descriptionSource":"CPANSec","description":"CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route.\n\nEvery CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search->find without validation. find splits the name on \"::\" and joins the parts into a file path, so a name such as \"..::..::..::etc::motd\" escapes @INC.\n\nAny file the server process can read is reachable. Only POD is rendered, but a file with a POD directive and no \"=cut\" is POD to the end of the file.","score":null,"severity":"unknown","published":"2026-10-30T12:34:35.614Z","modified":"2026-10-30T15:05:29.332Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"","name":"CallBackery","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"0.60.1","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:cpan/CallBackery","cpes":[],"source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-118988"}],"remediation":[{"text":"Upgrade to CallBackery 0.60.1 or later.","source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-118988"}],"references":["https://metacpan.org/release/OETIKER/CallBackery-0.60.1/source/CHANGES","https://github.com/oetiker/callbackery/commit/128efe804fde41bba9633fe00dc94e30f12087fb.patch","http://www.openwall.com/lists/oss-security/2026/10/30/11"],"sources":[{"name":"CVE","id":"CVE-2026-118988","modified":"2026-10-30T15:05:29.332Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118988"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-30T15:17:05.435Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:10:30.844Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T12:55:42.259Z","attemptedAt":"2026-10-30T12:55:42.259Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T12:55:42.242Z","attemptedAt":"2026-10-30T12:55:42.242Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T12:55:43.157Z","attemptedAt":"2026-10-30T12:55:43.157Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T12:55:43.086Z","attemptedAt":"2026-10-30T12:55:43.086Z"}],"evidence":[],"aiSummary":{"text":"CallBackery for Perl, versions before 0.60.1, allows unauthenticated clients to read the POD of any file via path traversal in the /doc route. The vulnerability occurs due to a lack of validation in the documentation plugin. Any file the server process can read is potentially reachable.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T12:56:01.478Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118988"}]}}