CVE-2026-118990None▾ SunlitCallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump<pid> and never removes…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup.
getConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump<pid> and never removes it. The file takes the process umask, and a symlink planted at that predictable name is followed.
The dump holds every user's password hash and every value saved by the application's forms. A local user can read these after any backup, and may redirect the dump to a file of their choosing.
CallBackery < 0.62.0Upgrade to CallBackery 0.62.0 or later, and delete any leftover /tmp/cbdump* files.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118992High· 8.4CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup
CVE-2026-118987NoneCallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header
CVE-2026-118986NoneCallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()
CVE-2026-118991NoneCallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key
CVE-2026-118996NoneCallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig
CVE-2026-118994NoneCallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name