CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup.

getConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump<pid> and never removes it. The file takes the process umask, and a symlink planted at that predictable name is followed.

The dump holds every user's password hash and every value saved by the application's forms. A local user can read these after any backup, and may redirect the dump to a file of their choosing.

Üreticinin çözüm notu (İngilizce)

Upgrade to CallBackery 0.62.0 or later, and delete any leftover /tmp/cbdump* files.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• metacpan.org/release/OETIKER/CallBackery-0.62.0/changes Diğer

Kayıt geçmişi

1. 6 Kas 2026 20:00CVSS puanı değişti: – → 5.5
2. 30 Eki 2026 16:12Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-118986CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()
• 5,3 CVE-2026-118987CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header
• 7,5 CVE-2026-118991CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key
• 8,4 CVE-2026-118992CallBackery (Perl) yapılandırma yedeği geri yüklemede işletim sistemi komutu çalıştırma
• 7,5 CVE-2026-118993CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI
• 9,8 CVE-2026-118994CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name