restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code.
Anyone who can supply a backup to be restored can run arbitrary commands as the application user.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
No advisories yet.
Solution
Upgrade to CallBackery 0.62.0 or later.
Workaround
No workaround given by the vendor.
Fri, 30 Oct 2026 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code. Anyone who can supply a backup to be restored can run arbitrary commands as the application user. | |
| Title | CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup | |
| Weaknesses | CWE-78 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-30T13:11:55.375Z
Reserved: 2026-10-29T10:58:47.285Z
Link: CVE-2026-118992
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-30T13:18:31.990
Modified: 2026-10-30T13:18:31.990
Link: CVE-2026-118992
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-30T14:30:08Z