Skip to content
Fencer Intel
critical 9.8

CVE-2026-78030 json

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM

published 2mo ago modified last mo. also EUVD-2026-83584 , GHSA-wqmw-wqwx-3fr7

Unreviewed: the maintainers' own advisory

Published by the maintainers on their GitHub repository perl5-dbi/dbi. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.

DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.

The MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.

A caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.

For example,

my $dsn = "dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm" my $dbh = DBI->connect( $dsn );

Note that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.

Patch / fix

  • perl dbi 1.653
  • libdbi-perl Debian 12 1.643-4+deb12u3
  • libdbi-perl Debian 14 1.653-1

debian advisories DEBIAN-CVE-2026-78030

  • libdbi-perl Ubuntu 22.04 LTS 1.643-3ubuntu0.4
  • libdbi-perl Ubuntu 24.04 LTS 1.643-4ubuntu0.4
  • libdbi-perl Ubuntu 26.04 LTS 1.647-1ubuntu0.26.04.4
  • libdbi-perl Ubuntu Pro 14.04 LTS 1.630-1ubuntu0.1~esm9
  • libdbi-perl Ubuntu Pro 16.04 LTS 1.634-1ubuntu0.2+esm5
  • libdbi-perl Ubuntu Pro 18.04 LTS 1.640-1ubuntu0.3+esm4
  • libdbi-perl Ubuntu Pro 20.04 LTS 1.643-1ubuntu0.1+esm4

ubuntu advisories UBUNTU-CVE-2026-78030

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • perl-DBI SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.642-150200.3.26.1
  • perl-DBI SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Basesystem 15 SP7 1.647.0-150600.12.21.1
  • perl-DBI SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 1.647.0-160000.6.1
  • perl-DBI SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.628-5.24.1

suse advisories SUSE-SU-2026:4612-1SUSE-SU-2026:4386-1SUSE-SU-2026:23919-1SUSE-SU-2026:23952-1SUSE-SU-2026:4346-1

  • perl-DBI openSUSE Leap 16.0 1.647.0-160000.6.1
  • perl-DBI openSUSE Tumbleweed 1.653.0-1.1

opensuse advisories openSUSE-SU-2026:21960-1openSUSE-SU-2026:11754-1

  • perl-DBI Azure Linux 3.0 1.655-1

azure linux advisories AZL-103475

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2026-78030 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-78030 updated cvss 7.5

perl-DBI: DBI: Loading of arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM

  • Red Hat Enterprise Linux 6 perl-DBI
    affected: workaround, no fix planned “Do not allow untrusted input to control dbm_type or dbm_mldbm (including DSN fragments). Prefer not exposing DBD::DBM connect parameters to less-trusted parties.”
  • Red Hat Enterprise Linux 7 perl-DBI
    affected: workaround, no fix available “Do not allow untrusted input to control dbm_type or dbm_mldbm (including DSN fragments). Prefer not exposing DBD::DBM connect parameters to less-trusted parties.”
  • Red Hat Enterprise Linux AppStream (v. 8) perl-DBI 1.641-12.module+el8.10.0+25253+4e8e7ec8, perl-DBI 1.641-12.module+el8.10.0+25253+8e5064e3
    fixed: vendor fix “Do not allow untrusted input to control dbm_type or dbm_mldbm (including DSN fragments). Prefer not exposing DBD::DBM connect parameters to less-trusted parties.” RHSA-2026:99210
  • Red Hat Enterprise Linux AppStream (v. 9) perl-DBI 1.643-12.el9_9.3
    fixed: vendor fix “Do not allow untrusted input to control dbm_type or dbm_mldbm (including DSN fragments). Prefer not exposing DBD::DBM connect parameters to less-trusted parties.” RHSA-2026:99208
  • Red Hat Enterprise Linux AppStream (v. 10) perl-DBI 1.643-30.el10_3.3
    fixed: vendor fix “Do not allow untrusted input to control dbm_type or dbm_mldbm (including DSN fragments). Prefer not exposing DBD::DBM connect parameters to less-trusted parties.” RHSA-2026:99209
  • Red Hat Enterprise Linux AppStream EUS (v.9.8) perl-DBI 1.643-9.el9_8.8
    fixed: vendor fix “Do not allow untrusted input to control dbm_type or dbm_mldbm (including DSN fragments). Prefer not exposing DBD::DBM connect parameters to less-trusted parties.” RHSA-2026:99121
  • Red Hat Enterprise Linux AppStream EUS (v.10.2) perl-DBI 1.643-26.el10_2.8
    fixed: vendor fix “Do not allow untrusted input to control dbm_type or dbm_mldbm (including DSN fragments). Prefer not exposing DBD::DBM connect parameters to less-trusted parties.” RHSA-2026:99120
  • Red Hat Enterprise Linux BaseOS (v. 8) perl-DBI 1.641-5.el8_10
    fixed: vendor fix “Do not allow untrusted input to control dbm_type or dbm_mldbm (including DSN fragments). Prefer not exposing DBD::DBM connect parameters to less-trusted parties.” RHSA-2026:99162

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
last mo.

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness
  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of perl5-dbi/dbi published their own advisory on GitHub. Reviewed sources take precedence over it.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.