# CVE-2026-118992: CallBackery OS command execution via sqlite3 shell in backup restore

Source: https://junglewise.ai/threats/cve-2026-118992-callbackery-versions-before-0-62-0-for-perl-allow-os-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-118992 · Severity: info · Published 2026-10-30

CallBackery is a Perl-based application framework that uses SQLite databases to store configuration. The vulnerability allows anyone with the ability to provide a backup file to execute arbitrary operating system commands by embedding shell directives in the database dump, which are processed by the sqlite3 command-line tool during restoration. An attacker could gain full control of the application server and access sensitive data.

Technologies: [OETIKER CallBackery](https://junglewise.ai/threats/technologies/callbackery). Vendors: [OETIKER](https://junglewise.ai/threats/vendors/oetiker).

## Quick answers

**Is CVE-2026-118992 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118992 being exploited in the wild.

**How severe is CVE-2026-118992?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** OETIKER CallBackery before 0.62.0.

**Is there a fix for CVE-2026-118992?** Yes: fixed in 0.62.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118992 attacked?** It is attacked with local access or over the network, in a software library.

**Am I affected by CVE-2026-118992?** Check whether you run OETIKER CallBackery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.62.0

## Technical details

The restoreConfigBlob() function passes a database dump directly to the sqlite3 shell without sanitizing input, allowing shell metacommands like .shell, .system, and .load to execute arbitrary code. This requires an attacker to supply a malicious backup file that will be restored, and the vulnerability is fixed in version 0.62.0 by replaying the database as plain SQL and refusing shell commands and certain SQL constructs.

## Affected products

- Oetiker CallBackery before 0.62.0

## Timeline

- 2026-10-29: patched
- 2026-10-30: disclosed

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes](https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes)

## Related threats

- [CallBackery session cookie age validation bypass in X-Session-Cookie header](https://junglewise.ai/threats/cve-2026-118987-callbackery-versions-before-0-62-0-for-perl-accept-session)
- [CallBackery Perl session cookie forgery via weak random secret](https://junglewise.ai/threats/cve-2026-118986-callbackery-versions-before-0-62-0-for-perl-allow-session-cookie)
- [CallBackery unsalted HMAC-SHA1 password hashing](https://junglewise.ai/threats/cve-2026-13576-callbackery-versions-before-0-62-0-for-perl-store-user-passwords)
- [CallBackery regex pattern validation bypass in form fields](https://junglewise.ai/threats/cve-2026-118995-callbackery-versions-before-0-62-0-for-perl-accept-unintended)
- [CallBackery log injection via newlines in login name](https://junglewise.ai/threats/cve-2026-118994-callbackery-versions-before-0-62-0-for-perl-allow-log-injection)