CVE-2026-78030: DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbmtype and dbmmldbm attributes in DBD::DBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.655-1 - Upgrade
Upgrade
debian/libdbi-perlto a version that resolves this vulnerability.Fixed in 1.643-4+deb12u3Fixed in 1.655-1 - Upgrade
Upgrade
DBI for Perlto a version that resolves this vulnerability.Fixed in 1.653
Event History
Frequently Asked Questions
What applications are realistically exposed to this issue?
Applications using DBD::DBM are exposed when an untrusted party can influence the dbm_type or dbm_mldbm connect attribute. This can occur when those values are accepted through a DSN fragment or a parameter that selects the storage backend.
What does an attacker need to exploit it?
The attacker needs control over either dbm_type or dbm_mldbm during connection setup and must be able to name a file that Perl can load. Exploitation causes Perl to run the selected file's file-scope code.
Do proxy or remote DBI deployments change the exposure?
Yes. DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer only checks that a DSN begins with a driver prefix. Deployments using either should review whether remote users can supply or alter DSNs or connect attributes.
What can be done before upgrading?
Do not allow untrusted input to select dbm_type or dbm_mldbm. Construct DSNs and connect attributes from fixed, trusted values rather than passing through user-controlled DSN fragments or backend-selection parameters.