CVE-2026-118994
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record. An unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing.
| CWE | CWE-117 |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for
Be the first to know when new unknown vulnerabilities are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup