critical 9.8

CVE-2026-78030 json

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM

published 2026-09-19 50 d ago modified 2026-09-22 47 d ago also EUVD-2026-83584

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits: 0; none known

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.

DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.

The MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.

A caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.

For example,

my $dsn = "dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm" my $dbh = DBI->connect( $dsn );

Note that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.

Patch / fix

distros 5 links 1

debian ubuntu suse opensuse azure linux

libdbi-perl Debian 12 1.643-4+deb12u3
libdbi-perl Debian 14 1.653-1

debian advisories DEBIAN-CVE-2026-78030

libdbi-perl Ubuntu 22.04 LTS 1.643-3ubuntu0.4
libdbi-perl Ubuntu 24.04 LTS 1.643-4ubuntu0.4
libdbi-perl Ubuntu 26.04 LTS 1.647-1ubuntu0.26.04.4
libdbi-perl Ubuntu Pro 14.04 LTS 1.630-1ubuntu0.1~esm9
libdbi-perl Ubuntu Pro 16.04 LTS 1.634-1ubuntu0.2+esm5
libdbi-perl Ubuntu Pro 18.04 LTS 1.640-1ubuntu0.3+esm4
libdbi-perl Ubuntu Pro 20.04 LTS 1.643-1ubuntu0.1+esm4

ubuntu advisories UBUNTU-CVE-2026-78030

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

perl-DBI SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.642-150200.3.26.1
perl-DBI SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Basesystem 15 SP7 1.647.0-150600.12.21.1
perl-DBI SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 1.647.0-160000.6.1
perl-DBI SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.628-5.24.1

suse advisories SUSE-SU-2026:4612-1 SUSE-SU-2026:4386-1 SUSE-SU-2026:23919-1 SUSE-SU-2026:23952-1 SUSE-SU-2026:4346-1

perl-DBI openSUSE Leap 16.0 1.647.0-160000.6.1
perl-DBI openSUSE Tumbleweed 1.653.0-1.1

opensuse advisories openSUSE-SU-2026:21960-1 openSUSE-SU-2026:11754-1

perl-DBI Azure Linux 3.0 1.655-1

azure linux advisories AZL-103475

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/perl5-dbi/dbi@315c6ce commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-78030 updated 2026-11-04 cvss 7.5

perl-DBI: DBI: Loading of arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM

Red Hat Enterprise Linux 6 perl-DBI 1.643-26.el10_2.7
affected: workaround, no fix planned “Do not allow untrusted input to control dbm_type or dbm_mldbm (including DSN fragments). Prefer not exposing DBD::DBM connect parameters to less-trusted parties.”
Red Hat Enterprise Linux 7 perl-DBI 1.643-26.el10_2.7 Red Hat Enterprise Linux 8 perl-DBI, perl-DBI 1.643-26.el10_2.7 Red Hat Enterprise Linux 9 perl-DBI, perl-DBI 1.643-26.el10_2.7 Red Hat Enterprise Linux 10 perl-DBI 1.643-26.el10_2.7
affected: workaround, no fix available “Do not allow untrusted input to control dbm_type or dbm_mldbm (including DSN fragments). Prefer not exposing DBD::DBM connect parameters to less-trusted parties.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 50 d ago (2026-09-20)

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness

CWE-470 Use of Externally-Controlled Input to Select Classes or Code

References

github.com /perl5-dbi/dbi/commit/315c6ce703b8b3cbe9188062d9ec80730293554a.patch
patch
github.com /perl5-dbi/dbi/security/advisories/GHSA-wqmw-wqwx-3fr7
vendor-advisory
metacpan.org /release/HMBRAND/DBI-1.653/changes
release-notes
openwall.com /lists/oss-security/2026/09/19/4

Sources

CVE List CVE-2026-78030
NVD CVE-2026-78030

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary