CVE-2026-118994None▾ SunlitCallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name.
login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record.
An unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing.
CallBackery < 0.62.0Upgrade to CallBackery 0.62.0 or later.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118992High· 8.4CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup
CVE-2026-118987NoneCallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header
CVE-2026-118990NoneCallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup
CVE-2026-118986NoneCallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()
CVE-2026-118991NoneCallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key
CVE-2026-118996NoneCallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig