CallBackery before 0.60.1 exposes POD via /doc path traversal
Original title: CVE-2026-118988: CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route
Unauthenticated clients can read the POD of any file through the Perl app’s /doc route; 0.60.1 is the fix.
Robert Rothenberg reported CVE-2026-118988 in CallBackery for Perl. Versions before 0.60.1 let unauthenticated clients read the POD of any file through path traversal in the /doc route. The notice points to the MetaCPAN distribution. The available text does not mention exploitation or a workaround.
Unconfirmed: The snippet does not say whether files outside POD content can be read.
- The vulnerable route is /doc.
- Access does not require authentication.
- The fixed version named is 0.60.1.
- The report was posted to oss-security on October 30.
Impact: Unauthenticated read of POD from arbitrary files
| Product | Affected | Fixed in |
|---|---|---|
| CallBackery | before 0.60.1 | 0.60.1 |
- 1.Upgrade CallBackery to version 0.60.1.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-118988 | Unauthenticated path traversal in CallBackery /doc before 0.60.1 | 7.5 | — |
From the original article
Posted by Robert Rothenberg on Oct 30 ======================================================================== https://metacpan. org/dist/CallBackery VCS Repo: ...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.