---
id: CVE-2026-118988
title: >-
  CallBackery versions before 0.60.1 for Perl let unauthenticated clients read
  the POD of any file via path traversal in the /doc route
summary: >-
  CallBackery versions before 0.60.1 for Perl let unauthenticated clients read
  the POD of any file via path traversal in the /doc route.


  Every CallBackery application mounts its documentation plugin at /doc, ahead
  of any session check. Th…
severity: none
cwe:
  - CWE-22
product: CallBackery
affected:
  - CallBackery < 0.60.1
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:05:29.332Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118988'
references:
  - url: 'https://metacpan.org/release/OETIKER/CallBackery-0.60.1/source/CHANGES'
  - url: >-
      https://github.com/oetiker/callbackery/commit/128efe804fde41bba9633fe00dc94e30f12087fb.patch
tags:
  - cve.org
epss: 0.00239
epssPercentile: 0.1512
ingestedAt: '2026-11-05T16:07:30.327Z'
---

## Overview

CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route.

Every CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search->find without validation. find splits the name on "::" and joins the parts into a file path, so a name such as "..::..::..::etc::motd" escapes @INC.

Any file the server process can read is reachable. Only POD is rendered, but a file with a POD directive and no "=cut" is POD to the end of the file.

## Affected

- `CallBackery < 0.60.1`

## Remediation

Upgrade to CallBackery 0.60.1 or later.