CVE-2026-78030: Perl DBI DBD::DBM RCE Vulnerability

CVE-2026-78030 Overview

CVE-2026-78030 is an arbitrary module load vulnerability in the Perl DBI (Database Interface) module prior to version 1.653. The flaw resides in DBD::DBM, which passes the dbm_type and dbm_mldbm connect attributes to Perl's require without validating that the values name a module. Because require treats path-shaped strings as literal filenames and bypasses @INC, an attacker who controls either attribute can force Perl to load and execute the file-scope code of any file on disk. The issue is tracked under CWE-470: Use of Externally-Controlled Input to Select Classes or Code.

Critical Impact
An attacker who can influence a Data Source Name (DSN) fragment or a parameter selecting a storage backend can achieve arbitrary code execution in the context of the Perl process.

Affected Products

Perl DBI module versions before 1.653
DBD::DBM driver bundled with vulnerable DBI releases
Applications exposing DBD::Gofer or DBI::ProxyServer that forward DSN attributes to the server side

Discovery Timeline

2026-09-19 - CVE-2026-78030 published to the National Vulnerability Database (NVD)
2026-09-19 - Coordinated disclosure via the OpenWall OSS-Security Discussion
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-78030

Vulnerability Analysis

The vulnerability is a code-selection flaw in DBD::DBM, the Perl DBI driver that ties SQL access to DBM-format files. When a caller opens a DBM connection, DBD::DBM forwards the dbm_type and dbm_mldbm connect attributes directly to require. Perl's require interprets any value containing directory separators as a literal path rather than a module name, and skips the standard @INC search. This means the attribute value chooses the exact file that Perl parses and executes at load time.

For dbm_mldbm, the driver prepends the MLDBM::Serializer:: prefix. However, this prefix is not a security boundary. Only the :: separators are rewritten to /; forward slashes in the attribute value are preserved. A value such as ../../Untrusted.pm traverses out of the serializer directory and reaches any file the process can read. The same value is also assigned to $MLDBM::Serializer, which MLDBM later loads the same way when tying the table.

Root Cause

The root cause is missing input validation on class-selection attributes [CWE-470]. DBD::DBM treats untrusted strings as trusted module identifiers and hands them to require without confirming that the value names a legitimate Perl package.

Attack Vector

Exploitation requires only that an attacker influence the dbm_type or dbm_mldbm value passed to DBI->connect. Common exposure paths include DSN fragments constructed from user input, HTTP parameters selecting a storage backend, and remote DBI transports. DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer validates only that the DSN begins with a driver prefix, extending the attack surface across the network.

perl

# Example exploitation via a malicious DSN (from the advisory)
my $dsn = "dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm";
my $dbh = DBI->connect( $dsn );
# Perl loads and executes the file-scope code of Untrusted.pm

Detection Methods for CVE-2026-78030

Indicators of Compromise

DSN strings containing dbm_type= or dbm_mldbm= with values that include /, \, or .. sequences
Perl processes reading .pm files from paths outside the standard @INC directories or the MLDBM/Serializer/ tree
Unexpected child processes, network connections, or file writes originating from applications that use DBI and DBD::DBM
Log entries from DBI::ProxyServer or DBD::Gofer accepting connect attributes with path-shaped values

Detection Strategies

Inventory installed Perl distributions and query DBI->VERSION to flag hosts running DBI below 1.653
Inspect application source for calls to DBI->connect that concatenate untrusted input into the DSN or attribute hash
Instrument Perl runtime auditing (for example, via Devel::Hook or open handlers) to log every module loaded through DBD::DBM

Monitoring Recommendations

Alert on process telemetry showing perl opening .pm files under user-writable directories such as /tmp, /var/tmp, or upload staging paths
Monitor DBI proxy and Gofer server logs for DSNs containing directory traversal sequences
Correlate web-application request logs with subsequent Perl module loads to identify parameter-driven exploitation attempts

How to Mitigate CVE-2026-78030

Immediate Actions Required

Upgrade DBI to version 1.653 or later on every host running Perl applications that use DBD::DBM
Audit application code paths that build DSN strings or attribute hashes and remove any use of untrusted input in dbm_type and dbm_mldbm
Restrict exposure of DBI::ProxyServer and DBD::Gofer endpoints to trusted networks until patching is complete

Patch Information

The fix landed in DBI 1.653 and loads the serializer class through Module::Load, which rejects path-shaped values and requires a valid module name. Details are available in the GitHub Security Advisory GHSA-wqmw-wqwx-3fr7, the GitHub Patch Commit, and the MetaCPAN Release Changes. The patch also adds Params::Util 1.100 as a dependency and introduces t/53dbm_module_name.t to enforce that dbm_type and dbm_mldbm name a module rather than a path.

text

 t/50dbm_simple.t		simple DBD::DBM tests
 t/51dbm_file.t			extended DBD::File tests (through DBD::DBM)
 t/52dbm_complex.t		Complex DBD::DBM tests with SQL::Statement
+t/53dbm_module_name.t		dbm_type / dbm_mldbm must name a module, not a path

Source: GitHub Patch Commit

Workarounds

Validate dbm_type and dbm_mldbm values against a strict allowlist of known-good module names before passing them to DBI->connect
Reject any DSN containing /, \, or .. characters in DBM-related attributes
Run Perl applications under least-privilege service accounts and restrict filesystem access so attacker-controlled paths cannot host .pm files

bash

# Verify installed DBI version and upgrade via CPAN
perl -MDBI -e 'print $DBI::VERSION, "\n"'
cpan install DBI@1.653