---
id: CVE-2026-118990
title: >-
  CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the
  configuration database in /tmp when taking a configuration backup
summary: >-
  CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the
  configuration database in /tmp when taking a configuration backup.


  getConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump<pid> and
  never removes…
severity: none
cwe:
  - CWE-379
  - CWE-59
product: CallBackery
affected:
  - CallBackery < 0.62.0
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T13:12:29.396Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118990'
references:
  - url: 'https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes'
tags:
  - cve.org
epss: 0.00161
epssPercentile: 0.05377
ingestedAt: '2026-11-05T16:07:30.243Z'
---

## Overview

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup.

getConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump<pid> and never removes it. The file takes the process umask, and a symlink planted at that predictable name is followed.

The dump holds every user's password hash and every value saved by the application's forms. A local user can read these after any backup, and may redirect the dump to a file of their choosing.

## Affected

- `CallBackery < 0.62.0`

## Remediation

Upgrade to CallBackery 0.62.0 or later, and delete any leftover /tmp/cbdump* files.