{"id":"CVE-2026-118988","state":"PUBLISHED","title":"CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route","description":"CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route.\n\nEvery CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search->find without validation. find splits the name on \"::\" and joins the parts into a file path, so a name such as \"..::..::..::etc::motd\" escapes @INC.\n\nAny file the server process can read is reachable. Only POD is rendered, but a file with a POD directive and no \"=cut\" is POD to the end of the file.","publishedAt":"2026-10-30T12:34:35.614Z","updatedAt":"2026-10-30T15:05:29.332Z","severity":null,"assigner":"CPANSec","products":["CallBackery"],"affected":[{"packageName":"CallBackery","packageURL":"pkg:cpan/CallBackery","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.60.1","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","modules":["CallBackery"],"programFiles":["lib/CallBackery/Plugin/Doc.pm"],"programRoutines":[{"name":"CallBackery::Plugin::Doc::register"}],"repo":"https://github.com/oetiker/callbackery"}],"references":["https://metacpan.org/release/OETIKER/CallBackery-0.60.1/source/CHANGES","https://github.com/oetiker/callbackery/commit/128efe804fde41bba9633fe00dc94e30f12087fb.patch","http://www.openwall.com/lists/oss-security/2026/10/30/11"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-30T15:18:06.520Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/118xxx/CVE-2026-118988.json","commit":"70fdf27998a84c5869ef58058ee273012c4794a3","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-118988","state":"PUBLISHED","datePublished":"2026-10-30T12:34:35.614Z","dateUpdated":"2026-10-30T15:05:29.332Z","assignerShortName":"CPANSec","assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateReserved":"2026-10-29T10:48:23.002Z"},"containers":{"cna":{"title":"CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route","descriptions":[{"lang":"en","value":"CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route.\n\nEvery CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search->find without validation. find splits the name on \"::\" and joins the parts into a file path, so a name such as \"..::..::..::etc::motd\" escapes @INC.\n\nAny file the server process can read is reachable. Only POD is rendered, but a file with a POD directive and no \"=cut\" is POD to the end of the file."}],"affected":[{"packageName":"CallBackery","packageURL":"pkg:cpan/CallBackery","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.60.1","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","modules":["CallBackery"],"programFiles":["lib/CallBackery/Plugin/Doc.pm"],"programRoutines":[{"name":"CallBackery::Plugin::Doc::register"}],"repo":"https://github.com/oetiker/callbackery"}],"references":[{"url":"https://metacpan.org/release/OETIKER/CallBackery-0.60.1/source/CHANGES","tags":["release-notes"]},{"url":"https://github.com/oetiker/callbackery/commit/128efe804fde41bba9633fe00dc94e30f12087fb.patch","tags":["patch"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CPANSec","orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateUpdated":"2026-10-30T12:34:35.614Z"},"solutions":[{"lang":"en","value":"Upgrade to CallBackery 0.60.1 or later."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"cpansec-cna-tool 0.1"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/11"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-10-30T15:05:29.332Z"}}]}}}