Cve-2026-118988 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-118988/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 01:32:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCallBackery: Path traversal vulnerability (CVE-2026-118988)https://feed.craftedsignal.io/briefs/2026-10-callbackery-path-traversal/Sat, 31 Oct 2026 01:32:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-callbackery-path-traversal/CallBackery versions prior to 0.60.1 allow unauthenticated remote attackers to read arbitrary file contents via path traversal in the /doc route.A path traversal vulnerability exists in the CallBackery Perl distribution that allows unauthenticated clients to access documentation files outside of the intended directory. This issue affects versions before 0.60.1.

Impact

Successful exploitation allows an unauthenticated attacker to read the Plain Old Documentation (POD) of arbitrary files on the system, which may disclose sensitive information contained within the source code or documentation files.

Recommendation

  • Update the CallBackery Perl distribution to version 0.60.1 or later immediately.
  • Review web server access logs for anomalous requests to the '/doc' URI path containing directory traversal sequences (e.g., '../').
]]>highadvisorywebserverpath-traversalcve-2026-118988