{"id":"CVE-2026-118988","published":"2026-10-30T13:18:31.647","lastModified":"2026-10-30T17:08:54.633","description":"CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route.\n\nEvery CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search->find without validation. find splits the name on \"::\" and joins the parts into a file path, so a name such as \"..::..::..::etc::motd\" escapes @INC.\n\nAny file the server process can read is reachable. Only POD is rendered, but a file with a POD directive and no \"=cut\" is POD to the end of the file.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/oetiker/callbackery/commit/128efe804fde41bba9633fe00dc94e30f12087fb.patch","tags":[]},{"url":"https://metacpan.org/release/OETIKER/CallBackery-0.60.1/source/CHANGES","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/11","tags":[]}],"exploitRefs":[{"url":"https://github.com/oetiker/callbackery/commit/128efe804fde41bba9633fe00dc94e30f12087fb.patch","tags":[]}],"hasPoc":true,"ai":null}