CVE-2026-118994

Full vulnerability record from the local CVENow database.

Description

CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record. An unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

9b29abf9-4ab0-4765-b253-1875cd9b441e

Published

2026-10-30 13:18:32.213000

Last modified

2026-10-30 13:18:32.213000

View original CVE JSON

{
  "id": "CVE-2026-118994",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-10-30T13:18:32.213",
  "lastModified": "2026-10-30T13:18:32.213",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name.\n\nlogin() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record.\n\nAn unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "CallBackery",
          "modules": [
            "CallBackery"
          ],
          "programFiles": [
            "lib/CallBackery/User.pm"
          ],
          "programRoutines": [
            {
              "name": "CallBackery::User::login"
            }
          ],
          "repo": "https://github.com/oetiker/callbackery",
          "packageURL": "pkg:cpan/CallBackery",
          "versions": [
            {
              "version": "0",
              "lessThan": "0.62.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-117"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ]
}