CVE-2026-78030

A flaw was found in Perl DBI's bundled DBD::DBM driver. This vulnerability allows arbitrary code execution because unvalidated connection attributes, such as dbm_type and dbm_mldbm, are passed directly to Perl's module loader without verification. An attacker who can influence database connection parameters or a Data Source Name (DSN) string can exploit this flaw to load and execute arbitrary files on the system.

A flaw was found in Perl DBI's bundled DBD::DBM driver. Unvalidated dbm_type and dbm_mldbm connect attributes are passed to require, allowing arbitrary module/file load when an attacker can influence those attributes (for example via a DSN fragment). Red Hat rates this as Important; exploitation requires the ability to influence DBD::DBM connect attributes, practical exploitation also requires attacker to be able to create a malicious .pm file on the target system (either by having a local access or by exploiting some other flaw to upload or create files on a remote system).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not allow untrusted input to control dbm_type or dbm_mldbm (including DSN fragments). Prefer not exposing DBD::DBM connect parameters to less-trusted parties.