---
id: CVE-2026-118994
title: >-
  CallBackery versions before 0.62.0 for Perl allow log injection via newlines
  in the login name
summary: >-
  CallBackery versions before 0.62.0 for Perl allow log injection via newlines
  in the login name.


  login() writes the login name to the application log without escaping control
  characters. The login RPC method needs no authentication, so a…
severity: none
cwe:
  - CWE-117
product: CallBackery
affected:
  - CallBackery < 0.62.0
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T13:10:57.452Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118994'
references:
  - url: 'https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes'
tags:
  - cve.org
epss: 0.0021
epssPercentile: 0.11313
ingestedAt: '2026-11-05T16:07:30.235Z'
---

## Overview

CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name.

login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record.

An unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing.

## Affected

- `CallBackery < 0.62.0`

## Remediation

Upgrade to CallBackery 0.62.0 or later.