Quick answers
- Is CVE-2026-118988 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-118988 being exploited in the wild.
- How severe is CVE-2026-118988?
- Informational severity, published 30 October 2026.
- Which products and versions are affected?
- OETIKER CallBackery before 0.60.1.
- Is there a fix for CVE-2026-118988?
- Yes: fixed in 0.60.1. Until then: Restrict access to the /doc route at the reverse proxy or firewall level, or upgrade to CallBackery 0.60.1 or later which validates document names to alphanumeric characters and "::" separators only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-118988 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-118988?
- Check whether you run OETIKER CallBackery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 0.60.1
Restrict access to the /doc route at the reverse proxy or firewall level, or upgrade to CallBackery 0.60.1 or later which validates document names to alphanumeric characters and "::" separators only.
Technical details
The /doc route in CallBackery::Plugin::Doc passes user-supplied document names directly to Pod::Simple::Search->find() without validation. The find() function treats "::" as a path separator, allowing names like "..::..::..::etc::motd" to escape the module search paths (@INC) and read arbitrary files. Since path traversal occurs within a single URL segment, it bypasses normalization by proxies and routers. The vulnerability requires no authentication and only POD content is rendered, but files with POD directives and no "=cut" directive expose file content to the end of the file.
Affected products
- oetiker CallBackery before 0.60.1
Timeline
- 2026-10-30: disclosed
- 2026-09-09: patched