Path Traversal Vulnerability in CallBackery by Oetiker
CVE-2026-118988

Currently unrated

Key Information:

Status
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118988?

CallBackery versions prior to 0.60.1 contain a vulnerability that allows unauthenticated clients to exploit a path traversal issue via the '/doc' route. When a request is made, the application permits the reading of any file's POD (Plain Old Documentation) without proper session checks. The vulnerability arises because requested paths are not validated, allowing potentially sensitive files to be accessed. This risk underscores the importance of careful input validation in web applications.

References

https://metacpan.org/release/OETIKER/CallBackery-0.60.1/s...
release-notes
https://github.com/oetiker/callbackery/commit/128efe804fd...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.