# CVE-2026-118988: CallBackery path traversal in /doc route

Source: https://junglewise.ai/threats/cve-2026-118988-callbackery-versions-before-0-60-1-for-perl-let-unauthenticated  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-118988 · Severity: info · Published 2026-10-30

CallBackery is a web application framework for Perl that serves API and documentation. An attacker can bypass authentication and read any file on the server that the web process can access by exploiting improper path validation in the documentation route, potentially exposing sensitive configuration files, source code, or other private data.

Technologies: [OETIKER CallBackery](https://junglewise.ai/threats/technologies/callbackery). Vendors: [OETIKER](https://junglewise.ai/threats/vendors/oetiker).

## Quick answers

**Is CVE-2026-118988 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118988 being exploited in the wild.

**How severe is CVE-2026-118988?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** OETIKER CallBackery before 0.60.1.

**Is there a fix for CVE-2026-118988?** Yes: fixed in 0.60.1. Until then: Restrict access to the /doc route at the reverse proxy or firewall level, or upgrade to CallBackery 0.60.1 or later which validates document names to alphanumeric characters and "::" separators only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118988 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118988?** Check whether you run OETIKER CallBackery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.60.1

Restrict access to the /doc route at the reverse proxy or firewall level, or upgrade to CallBackery 0.60.1 or later which validates document names to alphanumeric characters and "::" separators only.

## Technical details

The /doc route in CallBackery::Plugin::Doc passes user-supplied document names directly to Pod::Simple::Search->find() without validation. The find() function treats "::" as a path separator, allowing names like "..::..::..::etc::motd" to escape the module search paths (@INC) and read arbitrary files. Since path traversal occurs within a single URL segment, it bypasses normalization by proxies and routers. The vulnerability requires no authentication and only POD content is rendered, but files with POD directives and no "=cut" directive expose file content to the end of the file.

## Affected products

- oetiker CallBackery before 0.60.1

## Timeline

- 2026-10-30: disclosed
- 2026-09-09: patched

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/oetiker/callbackery/commit/128efe804fde41bba9633fe00dc94e30f12087fb.patch](https://github.com/oetiker/callbackery/commit/128efe804fde41bba9633fe00dc94e30f12087fb.patch)

## Related threats

- [CallBackery session cookie age validation bypass in X-Session-Cookie header](https://junglewise.ai/threats/cve-2026-118987-callbackery-versions-before-0-62-0-for-perl-accept-session)
- [CallBackery Perl session cookie forgery via weak random secret](https://junglewise.ai/threats/cve-2026-118986-callbackery-versions-before-0-62-0-for-perl-allow-session-cookie)
- [CallBackery unsalted HMAC-SHA1 password hashing](https://junglewise.ai/threats/cve-2026-13576-callbackery-versions-before-0-62-0-for-perl-store-user-passwords)
- [CallBackery regex pattern validation bypass in form fields](https://junglewise.ai/threats/cve-2026-118995-callbackery-versions-before-0-62-0-for-perl-accept-unintended)
- [CallBackery log injection via newlines in login name](https://junglewise.ai/threats/cve-2026-118994-callbackery-versions-before-0-62-0-for-perl-allow-log-injection)