CVE-2026-118990: CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup

Published Oct 30, 2026

Updated

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup.

getConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump<pid> and never removes it. The file takes the process umask, and a symlink planted at that predictable name is followed.

The dump holds every user's password hash and every value saved by the application's forms. A local user can read these after any backup, and may redirect the dump to a file of their choosing.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CallBackery for Perl to a version that resolves this vulnerability.
Fixed in 0.62.0
Operational
Delete any leftover /tmp/cbdump* files.

Event History

Oct 30, 2026

CVE Published

via MITRE·01:12 PM

Data Sourced

via MITRE·01:12 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:18 PM

DescriptionWeakness

Frequently Asked Questions

Who can access the exposed data?

Any local user can read the configuration database dump after a configuration backup occurs, if the dump is world-readable under the process umask. The dump contains every user's password hash and values saved through the application's forms.

What does an attacker need to exploit the file-write issue?

The attacker needs local access and the ability to plant a symlink at the predictable /tmp/cbdump<pid> path before the backup writes the dump. The sqlite3 shell follows that symlink, allowing the dump to be redirected to a file chosen by the attacker.

How can I check whether a system may already have exposed data?

Inspect /tmp for files named /tmp/cbdump<pid> that were created during configuration backups. These files are not removed by the affected getConfigBlob() behavior and may contain the configuration database dump.

What version addresses this issue?

The issue affects CallBackery for Perl versions before 0.62.0. Update to version 0.62.0 or later.

CVE-2026-118990: CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup

Remediation

Event History

Frequently Asked Questions

Who can access the exposed data?

What does an attacker need to exploit the file-write issue?

How can I check whether a system may already have exposed data?

What version addresses this issue?

Company

Resources

Contact

Frequently Asked Questions

Who can access the exposed data?

What does an attacker need to exploit the file-write issue?

How can I check whether a system may already have exposed data?

What version addresses this issue?