Description
CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup.

restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code.

Anyone who can supply a backup to be restored can run arbitrary commands as the application user.
Published: 2026-10-30
Score: 8.4 High
EPSS: n/a
KEV: No
Impact: OS Command Execution
Action: Apply Patch
AI Analysis

Impact

CallBackery for Perl has a flaw that lets a malicious backup file contain sqlite3 shell commands that are executed by the application. The import routine feeds a database dump to the sqlite3 command‑line shell, which interprets lines starting with a dot as its own commands. Consequently, a backup containing ".shell" or ".system" commands runs arbitrary OS commands, and ".load" can load native code. This allows an attacker to execute any command as the user running the CallBackery process.

Affected Systems

All installations of CallBackery released before version 0.62.0 for Perl are affected. The vulnerability was fixed in CallBackery 0.62.0 and later releases.

Risk and Exploitability

The CVSS score is not provided, but the impact is severe: arbitrary code execution at application‑user level. EPSS is not available and the vulnerability is not yet listed in CISA KEV, yet the exploitation requirement is low—anyone who can supply a backup to be restored can trigger the flaw. Attackers could compromise system integrity and confidentiality by executing shell commands, potentially escalating privileges if the application user is privileged.

Generated by OpenCVE AI on October 30, 2026 at 14:24 UTC.

Remediation

Vendor Solution

Upgrade to CallBackery 0.62.0 or later.

OpenCVE Recommended Actions

  • Upgrade CallBackery to version 0.62.0 or later
  • If an upgrade cannot be performed immediately, limit the source of backups to trusted uploads and validate the backup file before restoration, ensuring no sqlite3 shell commands are present
  • Configure the application to disable or sandbox the use of the sqlite3 command‑line shell so that even if a malicious backup is processed, it cannot execute system commands

Generated by OpenCVE AI on October 30, 2026 at 14:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Fri, 30 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
Description CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code. Anyone who can supply a backup to be restored can run arbitrary commands as the application user.
Title CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup
Weaknesses CWE-78
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: CPANSec

Published:

Updated: 2026-10-30T19:08:35.108Z

Reserved: 2026-10-29T10:58:47.285Z

Link: CVE-2026-118992

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-30T13:18:31.990

Modified: 2026-10-30T19:18:19.237

Link: CVE-2026-118992

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T14:30:08Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')