CVE-2026-78030

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-78030
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-78030.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-78030
Aliases
  • GHSA-wqmw-wqwx-3fr7
Downstream
Related
Published
2026-09-19T10:45:10Z
Modified
2026-09-20T11:45:12Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM
Details

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.

DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.

The MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.

A caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.

For example,

my $dsn = "dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm"
my $dbh = DBI->connect( $dsn );

Note that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.

Database specific 
{
    "cna_assigner":  "CPANSec",
    "cwe_ids":  [
        "CWE-470"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78030.json"
}
References

Affected packages

Git / github.com/perl5-dbi/dbi

Affected ranges

Type
GIT
Repo
https://github.com/perl5-dbi/dbi
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
44eb076aff904ba1eca8ca9ff4f3545ebea2f054
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.653"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

1.*
1.602
1.607
1.611_90
1.611_91
1.611_92
1.611_93
1.611_94
1.613_70
1.613_71
1.613_90
1.613_91
1.613_92
1.613_93
1.614_90
1.615
1.618
1.619
1.622
1.624
1.625
1.626
1.627
1.628
1.630
1.631
1.632
1.632_90
1.633
1.633_90
1.633_91
1.633_92
1.634
1.635
1.636
1.637
1.638
1.639
1.640
1.641
1.642
1.643
1.643_01
1.643_02
1.644
1.645
1.646
1.647
1.648
1.649
1.650
1.651
1.652
DBI-1.*
DBI-1.47
DBI-1.51
DBI-1.57
DBI-1.58

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-78030.json"