CVE-2026-78030: DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbmtype and dbmmldbm attributes in DBD::DBM.
DBD::DBM passes the dbmtype and dbmmldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.
The MLDBM::Serializer:: prefix that DBD::DBM prepends to dbmmldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.
A caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.
For example,
my $dsn = "dbi:DBM:fdir=/var/db;dbmtype=../../Untrusted.pm" my $dbh = DBI->connect( $dsn );
Note that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perl DBIto a version that resolves this vulnerability.Fixed in 1.653 - Compensating control
Avoid letting untrusted input control the DBI DBD::DBM connect attributes dbm_type or dbm_mldbm (e.g., do not build these attributes from a DSN fragment or other caller-supplied values).
Event History
Frequently Asked Questions
What applications are realistically exposed to this issue?
Applications using DBD::DBM are exposed when an untrusted party can influence the dbm_type or dbm_mldbm connect attribute. This can occur when those values are accepted through a DSN fragment or a parameter that selects the storage backend.
What does an attacker need to exploit it?
The attacker needs control over either dbm_type or dbm_mldbm during connection setup and must be able to name a file that Perl can load. Exploitation causes Perl to run the selected file's file-scope code.
Do proxy or remote DBI deployments change the exposure?
Yes. DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer only checks that a DSN begins with a driver prefix. Deployments using either should review whether remote users can supply or alter DSNs or connect attributes.
What can be done before upgrading?
Do not allow untrusted input to select dbm_type or dbm_mldbm. Construct DSNs and connect attributes from fixed, trusted values rather than passing through user-controlled DSN fragments or backend-selection parameters.