CVE-2026-118994 Details
Description
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record. An unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing.
A log injection vulnerability has been identified in CallBackery versions prior to 0.62.0 for Perl. The issue arises because the application log improperly handles newlines in the login name, allowing an unauthenticated attacker to inject forged log records. The login RPC method does not require authentication, so an attacker can exploit this by including a newline followed by text in the log record format, such as a fake administrator login.
Users are advised to update CallBackery to version 0.62.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes | CPANSec | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-117 | Improper Output Neutralization for Logs | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| CallBackery | < 0.62.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | CPANSec |