Vulnerability · Published Oct 30, 2026 · Assigned by CPANSec

CVE-2026-118988CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route

Unrated

In plain English

A path traversal in CallBackery. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS )–Not rated

Exploit odds (30 days)0.2%top 84.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route. Every CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search->find without validation. find splits the name on "::" and joins the parts into a file path, so a name such as "..::..::..::etc::motd" escapes @INC. Any file the server process can read is reachable. Only POD is rendered, but a file with a POD directive and no "=cut" is POD to the end of the file.

Affected products (as reported)

Vendor	Product	Versions
	CallBackery	0 – before 0.60.1

Weakness: CWE-22

In plain English

Official description

Affected products (as reported)

References