CVE-2026-78030
Description
A flaw was found in Perl DBI's bundled DBD::DBM driver. This vulnerability allows arbitrary code execution because unvalidated connection attributes, such as dbm_type and dbm_mldbm, are passed directly to Perl's module loader without verification. An attacker who can influence database connection parameters or a Data Source Name (DSN) string can exploit this flaw to load and execute arbitrary files on the system.
Statement
A flaw was found in Perl DBI's bundled DBD::DBM driver. Unvalidated dbm_type and dbm_mldbm connect attributes are passed to require, allowing arbitrary module/file load when an attacker can influence those attributes (for example via a DSN fragment). Red Hat rates this as Important; exploitation requires the ability to influence DBD::DBM connect attributes, practical exploitation also requires attacker to be able to create a malicious .pm file on the target system (either by having a local access or by exploiting some other flaw to upload or create files on a remote system).
Mitigation
Do not allow untrusted input to control dbm_type or dbm_mldbm (including DSN fragments). Prefer not exposing DBD::DBM connect parameters to less-trusted parties.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
