Cyber ·
CVE-2026-118988: CallBackery before 0.60.1 allows unauthenticated POD reading via path traversal
Security advisory for the CallBackery Perl distribution: versions before 0.60.1 let unauthenticated clients read the POD documentation of arbitrary files through the documentation route.
According to the advisory posted to the oss-sec list on October 30, 2026 by the CPAN Security Group, CVE-2026-118988 affects CallBackery, a Perl distribution, in all versions before 0.60.1. The flaw is a path traversal: an unauthenticated client can read the POD documentation of any file through the /doc route. The fix is in version 0.60.1. The advisory points to the distribution's MetaCPAN entry and its code repository as sources for verification.
Relevance to Rota Nacional: the topic is application security and has no direct link to the AI platform. Rota does not fix or monitor third-party libraries. For anyone using this material with AI, the advice is not to paste internal configurations, server names or snippets of internal code into models without review. The platform's automatic detection covers personal data such as CPF, CNPJ, e-mail, phone and names, but it does not alone identify infrastructure secrets; that review rests with the team.