Vulnerability · Published Oct 30, 2026 · Assigned by CPANSec
CVE-2026-118995CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator
Unrated
In plain English
A security flaw in CallBackery. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Official description
CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator() is documented to anchor the supplied pattern at both ends, but builds /^${rx}$/ without grouping the pattern. An alternation such as yes|no then accepts any value starting with yes or ending with no, and $ also accepts a value with one trailing newline. An authenticated user can submit values the pattern was meant to reject, which an application may then write into generated configuration files.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CallBackery | 0 – before 0.62.0 |
Weakness: CWE-625