CVE-2026-118995 Details
Description
CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator() is documented to anchor the supplied pattern at both ends, but builds /^${rx}$/ without grouping the pattern. An alternation such as yes|no then accepts any value starting with yes or ending with no, and $ also accepts a value with one trailing newline. An authenticated user can submit values the pattern was meant to reject, which an application may then write into generated configuration files.
A vulnerability exists in CallBackery versions prior to 0.62.0 for Perl, where the application improperly handles form field values. The issue arises in the regular expression validation, which is supposed to anchor patterns at both ends. Instead, it constructs a pattern that allows unintended matches. For example, a pattern like 'yes|no' could be bypassed by any value starting with 'yes' or ending with 'no'. Additionally, the pattern allows values with trailing newlines. This flaw enables authenticated users to submit values that the application should reject, potentially leading to the inclusion of these values in generated configuration files.
Users can upgrade to CallBackery version 0.62.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes | CPANSec | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-625 | Permissive Regular Expression | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| CallBackery | < 0.62.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | CPANSec |