UNKNOWN NVD

CVE-2026-118990

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump<pid> and never removes it. The file takes the process umask, and a symlink planted at that predictable name is followed. The dump holds every user's password hash and every value saved by the application's forms. A local user can read these after any backup, and may redirect the dump to a file of their choosing.

References

https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes

Published: 2026-10-30 · Source: NVD · Feed updated: 2026-10-30

This unknown severity vulnerability was published on 2026-10-30 via NVD.

vulnfeed aggregates 17475 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.