CallBackery: Path traversal vulnerability (CVE-2026-118988)
CallBackery versions prior to 0.60.1 allow unauthenticated remote attackers to read arbitrary file contents via path traversal in the /doc route.
CVE search metadata
CVE search record: CVE-2026-118988. KEV: no. Product: CallBackery (< 0.60.1). Brief: CallBackery: Path traversal vulnerability (CVE-2026-118988). Brief link: https://feed.craftedsignal.io/briefs/2026-10-callbackery-path-traversal/
Triage facts
Revision 1- Applicability
- CallBackery (< 0.60.1)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 31, 01:32 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
A path traversal vulnerability exists in the CallBackery Perl distribution that allows unauthenticated clients to access documentation files outside of the intended directory. This issue affects versions before 0.60.1.
Impact
Successful exploitation allows an unauthenticated attacker to read the Plain Old Documentation (POD) of arbitrary files on the system, which may disclose sensitive information contained within the source code or documentation files.
Recommendation
- Update the CallBackery Perl distribution to version 0.60.1 or later immediately.
- Review web server access logs for anomalous requests to the '/doc' URI path containing directory traversal sequences (e.g., '../').
Immediate actions
Upgrade CallBackery to 0.60.1 or later
Threat Hunt
Detect directory traversal attempts against the /doc endpoint
Data: Web server access logs
Mitigations
Upgrade to CallBackery 0.60.1
CVE-2026-118988