OS command execution in CallBackery via restored configuration backups
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-78.
Summary
CallBackery for Perl versions before 0.62.0 allow OS command execution through a restored configuration backup. The restore routine passes the database dump in the backup to the sqlite3 command-line shell, which runs lines starting with a dot as its own commands, such as .shell or .system. Anyone who can supply a backup to be restored can run arbitrary commands as the application user. This is classified as CWE-78.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code. Anyone who can supply a backup to be restored can run arbitrary commands as the application user.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | CallBackery | before 0.62.0 | 0.62.0 | Patch available | CNA |
- CallBackery Vendor— Affected before 0.62.0 Fixed in 0.62.0 Patch available CNA
Remediation
The fixed version is CallBackery 0.62.0. Upgrade CallBackery to version 0.62.0 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA CallBackery Fixed in 0.62.0
Timeline
- 2026-10-30 Threatist record created from CVE-2026-118992
- 2026-10-30 Alias added: GHSA-w32m-6wp6-8542
- 2026-10-30 CVSS score added · CISA ADP
- 2026-10-30 CISA SSVC decision points changed
References
Sources
- CVE-2026-118992 · CVE Program
- CVE-2026-118992 · NVD
- FIRST EPSS
- GHSA-w32m-6wp6-8542 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences