CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-118988: CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 11906

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-118988: CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route

CallBackery for Perl versions before 0.60.1 contain a path traversal vulnerability in the /doc route that allows unauthenticated clients to read POD (Plain Old Documentation) from any file on the system. The issue is tracked as CVE-2026-118988 and has been addressed in version 0.60.1 and later.

Why it matters: Perl developers using CallBackery below 0.60.1 should upgrade immediately to prevent unauthorized exposure of sensitive documentation and source code metadata from their systems.

CVEsCVE-2026-118988
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary