CVE-2026-118994

CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. The cookieConf() function rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter; the same cookie sent in the X-Session-Cookie header is accepted regardless of age.

CallBackery versions before 0.62.0 for Perl allow session cookie forgery due to a signing secret generated with rand(). The secret is built from two calls to the built-in rand(), seeded with 32 bits, so it has at most 2^32 possible values, and one signed cookie is enough to test each candidate offline.

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, no salt and no work factor, so equal passwords give equal hashes and guessing is fast.

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig() returns the caller's whole cbuser row, and getTableData() and getAllFieldValues() also return the note to users without the admin right.

CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. The function builds /^${rx}$/ without grouping the pattern, so an alternation such as yes|no accepts any value starting with yes or ending with no, and $ also accepts a value with one trailing newline.

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch hook removes PATH_INFO from the request URI with a substitution that interpolates PATH_INFO unquoted, so the client chooses both the pattern and the matched string.

CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoreConfigBlob() feeds the database dump to the sqlite3 command-line shell, which runs lines starting with a dot as its own commands, so .shell or .system runs an OS command and .load loads native code.

In CallBackery versions before 0.62.0 for Perl, configuration backups are encrypted with an AES key formed by padding the password with "x" characters and truncating to 32 bytes, with no salt and no key derivation. The first block of a backup holds a 16 hex digit length field, so decrypting one block confirms a password guess at raw AES speed.

In CallBackery versions before 0.62.0 for Perl, taking a configuration backup leaves a world-readable dump of the configuration database in /tmp. getConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump<pid> and never removes it; the file takes the process umask, and a symlink planted at that predictable name is followed.

In CallBackery versions before 0.60.1 for Perl, unauthenticated clients can read the POD of any file via path traversal in the /doc route. The route passes the requested name to Pod::Simple::Search->find without validation, and find splits the name on "::" and joins the parts into a file path, so a name such as "..::..::..::etc::motd" escapes @INC.