CVE-2026-78030
Received Received - Intake

Arbitrary Code Execution in DBD-DBM Perl Module

Publication date: 2026-09-19

Last updated on: 2026-09-20

Assigner: CPANSec

Description
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs. The MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table. A caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names. For example, my $dsn = "dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm" my $dbh = DBI->connect( $dsn ); Note that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-19
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-78030

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
perl dbi to 1.653 (exc)
perl dbd_dbm to 1.653 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-470 The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78030 is a vulnerability in DBI versions before 1.653 for Perl where arbitrary modules can be loaded due to unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes these attributes directly to Perl's require function without validation, allowing attackers to specify arbitrary module paths. Since require treats path-shaped strings as literal filenames, it can load and execute malicious code from unintended locations.

Detection Guidance

Check Perl DBI and DBD::DBM versions with: perl -MDBI -e 'print $DBI::VERSION' and perl -MDBD::DBM -e 'print $DBD::DBM::VERSION'. If versions are below 1.653, the system is vulnerable. Inspect Perl scripts using DBD::DBM for untrusted inputs in DSN fragments or storage backend parameters.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system if they can influence the dbm_type or dbm_mldbm attributes, such as through a DSN fragment or parameter. This could lead to full system compromise, data theft, or unauthorized access. The CVSS score of 9.8 indicates a critical risk with high impact on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage if exploited. The high severity of this issue makes it critical for compliance with data protection standards.

Mitigation Strategies

Upgrade DBI to version 1.653 or later. If upgrading is not possible, apply the upstream patch from the DBI repository. Review and sanitize all inputs used in DBD::DBM connection attributes like dbm_type and dbm_mldbm to prevent path traversal.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78030. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart