Няма оценка
CVSS
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Описание
Оригинално описание
CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route. Every CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search->find without validation. find splits the name on "::" and joins the parts into a file path, so a name such as "..::..::..::etc::motd" escapes @INC. Any file the server process can read is reachable. Only POD is rendered, but a file with a POD directive and no "=cut" is POD to the end of the file.
Засегнати продукти
- : преди 0.60.1
Вид слабост
История
- 30 октомври 2026 Публикувано
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-118988
- https://nvd.nist.gov/vuln/detail/CVE-2026-118988
- https://metacpan.org/release/OETIKER/CallBackery-0.60.1/source/CHANGES
- https://github.com/oetiker/callbackery/commit/128efe804fde41bba9633fe00dc94e30f12087fb.patch
- http://www.openwall.com/lists/oss-security/2026/10/30/11