The createRxValidator routine incorrectly constructs a regular expression by enclosing the supplied pattern directly between anchors without grouping. This flaw allows values that were intended to be rejected – for example, strings that begin with an alternate option or that contain a trailing newline – to pass validation. When an authenticated user submits such a value, the application may incorporate it into generated configuration files, potentially altering system behavior or granting unintended privileges.

CallBackery for Perl, all versions earlier than 0.62.0.

EPSS data is unavailable and the vulnerability is not yet listed in CISA KEV, indicating lower documented exploitation probability. However, because the flaw requires authentication, an attacker who has legitimate access can exploit it. The impact is confined to configuration tampering rather than arbitrary code execution, so the overall risk is moderate.