CallBackery versions before 0.62.0 for Perl contain a vulnerability that allows OS command execution via sqlite3 shell commands embedded in a restored configuration backup. The restoreConfigBlob() function feeds a database dump from a backup to the sqlite3 command-line shell, which executes lines starting with a dot as shell commands. This enables an attacker who can supply a backup to execute arbitrary commands with the application's user privileges.