{"id":"CVE-2026-118995","published":"2026-10-30T13:18:32.320","lastModified":"2026-10-30T17:08:54.633","description":"CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator.\n\ncreateRxValidator() is documented to anchor the supplied pattern at both ends, but builds /^${rx}$/ without grouping the pattern. An alternation such as yes|no then accepts any value starting with yes or ending with no, and $ also accepts a value with one trailing newline.\n\nAn authenticated user can submit values the pattern was meant to reject, which an application may then write into generated configuration files.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-625"],"vendors":[],"products":[],"references":[{"url":"https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}