CallBackery before 0.60.1 exposes POD via /doc path traversal
Unauthenticated clients can read the POD of any file through the Perl app’s /doc route; 0.60.1 is the fix.
46
CVE-2026-118988
Unauthenticated path traversal in CallBackery /doc before 0.60.1
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CallBackery for Perl mounts its documentation plugin at /doc before any session check. An unauthenticated client can request a name that Pod::Simple::Search->find turns into a path by splitting on "::", so sequences such as "..::..::..::etc::motd" escape @INC. Only POD is rendered, but a file with a POD directive and no "=cut" is treated as POD through the end, so any file the server process can read may be disclosed. Versions before 0.60.1 are affected.
What to do: Upgrade CallBackery to 0.60.1.
| Product | Affected | Fixed in |
|---|---|---|
| CallBackery for Perl | before 0.60.1 | 0.60.1 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route. Every CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search->find without validation. find splits the name on "::" and joins the parts into a file path, so a name such as "..::..::..::etc::motd" escapes @INC. Any file the server process can read is reachable. Only POD is rendered, but a file with a POD directive and no "=cut" is POD to the end of the file.
- Weakness
- CWE-22
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N