CVE-2026-118992 - CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configur
CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup.
restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code.
Anyone who can supply a backup to be restored can run arbitrary commands as the application user.
HIGH
Severity & confidence
Source severityhigh
Platform severityhigh
Confidencehigh
Exploitationunknown
CVSS8.4
Affected
Reporting sources (1)
NIST NVD - National Vulnerability Database
Timeline & provenance
Published2026-10-30T13:18:31
Last updated2026-11-02T13:05:43
Ingested2026-11-01T16:33:29
FreshnessNEAR-REAL-TIME
Threat typevulnerability
Recommended action
No recommended action published with this item - review the original source.
Next steps
- Identify affected systems in your environment.
- Apply the vendor patch or mitigation guidance.
- Review logs for indicators described in the advisory.
- Follow the affected vendor/product to track updates.
Confidence explanation
Reported by a government or cert-grade source (CISA, NCSC, NVD, ENISA, MSRC).
Source type: standards ยท Original: NIST NVD - National Vulnerability Database
