Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118995— CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator

Quick assessment

Affected
CVE-2026-118995
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 版本的 CallBackery 在 0.62.0 之前的版本中，其 函数在检查表单字段时，会接受本应被拒绝的值。 的文档说明会将提供的正则模式在首尾进行锚定，但实际构建的正则表达式为 ，并未对模式进行分组。因此，类似 这样的交替模式会接受任何以 "yes" 开头或以 "no" 结尾的值；此外，末尾的 锚点也会允许包含一个尾随换行符的值。 已认证用户可以提交本应被该模式拒绝的值，而应用程序随后可能将这些值写入生成的配置文件中，从而引发安全漏洞。

AI Predicted 6.5 Difficulty: Easy EPSS 0.32% · P25

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 0.62.0 affected

I. Basic Information for CVE-2026-118995

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator
Source: CVE Program / CVE List V5
Vulnerability Description
CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator() is documented to anchor the supplied pattern at both ends, but builds /^${rx}$/ without grouping the pattern. An alternation such as yes|no then accepts any value starting with yes or ending with no, and $ also accepts a value with one trailing newline. An authenticated user can submit values the pattern was meant to reject, which an application may then write into generated configuration files.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
宽松定义的正则表达式
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 0.62.0 -

II. Public POCs for CVE-2026-118995

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118995

请登录查看更多情报信息。

Other References for CVE-2026-118995 (1)

IV. Related Vulnerabilities

Same weakness: CWE-625