CallBackery EUVD-2026-113918

Exploitation requires the ability to supply a malicious configuration backup that is then restored through CallBackery's restoreConfigBlob() routine; the backup's database dump must contain an sqlite3 dot-command (.shell or .system to run an OS command, or .load to load native code), which the sqlite3 command-line shell executes because it treats dot-prefixed lines as its own commands rather than SQL. Limiting factors: the target must run a vulnerable version (before 0.62.0); the attacker must be able to deliver a backup and trigger its restoration (typically an administrative/operator restore operation, despite the input vector's PR:N); no user interaction beyond the restore action is otherwise needed, and commands run only with the privileges of the application user.

This is a genuine high-severity issue (CVSS 8.4) but one whose real-world priority is tempered by its access requirements. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N) describes a local, low-complexity, no-interaction flaw with full confidentiality, integrity and availability impact as the application user via OS command execution (CWE-78). However, the vector's PR:N conflicts with the description, which states exploitation requires 'anyone who can supply a backup to be restored' and runs through restoreConfigBlob() - a configuration-restore operation that in practice is an operator/administrative action rather than an anonymous one. Verify the true privilege requirement with the vendor, because PR:N materially overstates exposure if restore is gated behind authentication. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no public exploit identified at time of analysis; the only trigger evidence is the CPANSec/oss-security advisory describing the mechanism. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious-but-not-actively-exploited defect in a niche product. Net assessment: legitimate code-execution bug worth patching promptly, but the absence of exploitation signals plus the restore-access precondition make it a this-week remediation item rather than a drop-everything emergency.

An actor who can submit a configuration backup for restoration crafts a backup whose embedded SQLite dump contains a dot-command such as '.shell' or '.system'. When restoreConfigBlob() pipes that dump into the sqlite3 command-line shell, the shell interprets the dot-line and executes the embedded OS command as the application user. No public exploit code was identified; the mechanism is documented only in the advisory.