{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acallbackery_projectcallbackeryperl/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:callbackery_project:callbackery:*:*:*:*:*:perl:*:*"],"_cs_cves":[{"id":"CVE-2026-118988"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CallBackery (\u003c 0.60.1)"],"_cs_severities":["high"],"_cs_tags":["webserver","path-traversal","cve-2026-118988"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA path traversal vulnerability exists in the CallBackery Perl distribution that allows unauthenticated clients to access documentation files outside of the intended directory. This issue affects versions before 0.60.1.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to read the Plain Old Documentation (POD) of arbitrary files on the system, which may disclose sensitive information contained within the source code or documentation files.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the CallBackery Perl distribution to version 0.60.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous requests to the '/doc' URI path containing directory traversal sequences (e.g., '../').\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T01:32:01Z","date_published":"2026-10-31T01:32:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-callbackery-path-traversal/","summary":"CallBackery versions prior to 0.60.1 allow unauthenticated remote attackers to read arbitrary file contents via path traversal in the /doc route.","title":"CallBackery: Path traversal vulnerability (CVE-2026-118988)","url":"https://feed.craftedsignal.io/briefs/2026-10-callbackery-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:callbackery_project:callbackery:*:*:*:*:*:perl:*:*","version":"https://jsonfeed.org/version/1.1"}