CVE-2026-118992: CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup
CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup.
restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code.
Anyone who can supply a backup to be restored can run arbitrary commands as the application user.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CallBackeryto a version that resolves this vulnerability.Fixed in 0.62.0
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Any deployment that restores a configuration backup supplied by an untrusted party is exposed. The attacker does not need application privileges if they can cause their backup to be passed to the restore process.
What does an attacker need to exploit this issue?
They need the ability to supply a configuration backup that is restored through restoreConfigBlob(). A malicious database dump can include sqlite3 shell directives such as .shell, .system, or .load.
What is the impact of a successful exploit?
The attacker can execute arbitrary operating-system commands as the application user. They can also load native code through the sqlite3 .load command.
What can be done if updating is not immediately possible?
Do not restore configuration backups from untrusted or unverifiable sources. Restrict who can provide backups and ensure only trusted backup artifacts are submitted to the restore workflow.