CVE-2026-78030: DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM
Perl DBI before 1.653 loads arbitrary modules via unvalidated DBD::DBM dbm_type and dbm_mldbm attributes, enabling code execution with attacker-controlled attributes.
CVE-2026-78030 affects the Perl DBI database interface in all versions before 1.653. The DBD::DBM driver does not validate the dbm_type and dbm_mldbm attributes before using them to load Perl modules, so applications that pass attacker-controlled attributes to DBI connect can be made to load arbitrary modules, which can lead to code execution. Robert Rothenberg disclosed the flaw on the oss-security mailing list on September 19, 2026; users should upgrade to DBI 1.653.
- DBD::DBM's dbm_type and dbm_mldbm attributes are not validated before module loading.
- Affects DBI releases before 1.653; upgrading to 1.653 remediates the flaw.
- Impact is limited to applications that pass attacker-controlled attributes to DBI connect.
- Disclosure was made via the oss-security mailing list by maintainer Robert Rothenberg.
- CVEs
- CVE-2026-78030
- Organizations
- oss-security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-78030 | Arbitrary module load leading to code execution in Perl DBI (DBD::DBM) before 1.653 | 9.8 | — |
From the original article
Posted by Robert Rothenberg on Sep 19 ======================================================================== https://metacpan. org/dist/DBI https://github. com/perl5-dbi/dbi DBI...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.