https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-01T17:06:27.377864+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-118992 fkie_cve-2026-118992 2026-11-01T17:06:27.399460+00:00

CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup.

restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code.

Anyone who can supply a backup to be restored can run arbitrary commands as the application user.

 https://db.gcve.eu/vuln/ghsa-w32m-6wp6-8542 GHSA-w32m-6wp6-8542 2026-11-01T17:06:27.399537+00:00

CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup.

restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code.

Anyone who can supply a backup to be restored can run arbitrary commands as the application user.