CallBackery for Perl releases a configuration backup by writing a database dump directly to a temporary file named /tmp/cbdump<pid>. The dump contains every user’s password hash and all data submitted through the application’s forms, yet the file is left world‑readable and the system never removes it after the backup is complete. The process inherits the current umask, and a malicious user may replace the predictable file name with a symlink to a location of their choosing, further enabling data leakage. The flaw was reported only as a local vulnerability driven by a user’s ability to trigger a configuration backup. The consequence is that any local user who initiates a backup can read private credentials and application data.

CallBackery for Perl, any version earlier than 0.62.0. The vulnerability was discovered in all releases prior to the 0.62.0 update that added removal of the temporary file and removed symlink poisoning support.

The flaw is limited to local users who can trigger a backup; no remote exploit is documented. The exploit probability (EPSS) is not available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is not provided in the data, but the presence of password hashes and unrestricted file access suggest a high severity local privilege escalation. Because the attack requires local access, the primary vector is a legitimate user scenario.