CVE-2026-78030
UnknownSummary
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. These attributes are passed to require without checking that the value names a module, allowing loading and executing code from any file.
Risk Assessment
An attacker who can influence these attributes (e.g., via a DSN fragment) can execute code from any file on the system, leading to full compromise of the application or server.
Recommendation
Upgrade DBI to version 1.653 or later. Additionally, validate and restrict the values of dbm_type and dbm_mldbm attributes to prevent paths outside allowed directories.
Other vulnerabilities in DBI
See all- CVE-2026-73194Critical
In DBI for Perl before version 1.652, a heap out-of-bounds write occurs via an unvalidated numeric placeholder that sets the binder counter in preparse. A crafted statement can cause a write beyond the allocated buffer.
- CVE-2026-73193Critical
In DBI for Perl before version 1.652, a heap out-of-bounds write occurs on 32-bit Perl due to integer wraparound in the output buffer size computed by preparse. A very long statement can cause a write beyond the allocated buffer.
- CVE-2026-60082Critical
A vulnerability in the DBI library for Perl before version 1.651 does not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.
- CVE-2026-14740Critical
A vulnerability in the DBI library for Perl before version 1.650 causes an out-of-bounds read by one byte during processing of an initial SQL comment in the preparse method. The issue occurs when deleting a comment at the beginning of an SQL query.
- CVE-2026-14739Critical
A heap overflow vulnerability in DBI versions before 1.650 for Perl occurs when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2 million placeholders. Version 1.650 sets a hard limit of 99,999 placeholders.
- CVE-2026-9698Critical
DBI for Perl before version 1.648 saves error messages in a limited-size buffer (200 bytes) without length control. Attackers who can influence error text may cause a buffer overflow.
- CVE-2026-19546High
A flaw was found in DBI, which is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. Detailed information is available in the original description on the Red Hat website.
- CVE-2026-14380High
Vulnerability in DBI for Perl before version 1.650 allows code injection via the Profile attribute, which is interpolated in eval without validation. An attacker can control Profile through the DBI_PROFILE environment variable, direct assignment, or DSN clause, leading to arbitrary Perl code execution.
Original NVD description (English source)
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs. The MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table. A caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names. For example, my $dsn = "dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm" my $dbh = DBI->connect( $dsn ); Note that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.