Description

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs. The MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table. A caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names. For example, my $dsn = "dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm" my $dbh = DBI->connect( $dsn ); Note that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-19T11:16:37.667Z",
  "pubdate": "2026-09-19T11:16:37.667Z",
  "executiveSummary": "A critical security vulnerability exists in DBI versions prior to 1.653, specifically within the DBD::DBM component, allowing for arbitrary code execution.\nThe vulnerability is classified as an improper input validation flaw leading to arbitrary module loading. An attacker can supply a malicious DSN or connect attribute to trigger the loading and execution of unintended Perl files residing on the filesystem.\nThe affected product is the DBI Perl module, specifically the DBD::DBM driver. This issue poses a severe risk as it allows attackers to bypass intended security boundaries by forcing the Perl interpreter to execute arbitrary code via the 'require' function.\nThe vulnerability can be exploited if an application permits untrusted user input to influence the 'dbm_type' or 'dbm_mldbm' connect attributes. This is particularly dangerous in networked environments where DBI::Gofer or DBI::ProxyServer might propagate these attributes to remote or privileged contexts.\nSuccessful exploitation requires the ability to influence connection parameters and the presence of a targetable file on the server. If achieved, the attacker gains the execution context of the Perl process, potentially leading to full system compromise depending on the user privileges running the DBI-enabled application.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure handling of 'dbm_type' and 'dbm_mldbm' attributes within the DBD::DBM driver. The module passes these user-supplied strings directly to the Perl 'require' function without performing adequate validation or sanitization to ensure the input refers to a legitimate, trusted module.\nIn Perl, 'require' treats path-shaped strings as literal filenames rather than module names, bypassing the standard @INC lookup mechanism. By providing a crafted string, an attacker can perform path traversal to load arbitrary files from the filesystem. Furthermore, the 'dbm_mldbm' attribute is subject to prefix manipulation; while the driver prepends 'MLDBM::Serializer::', the implementation merely converts '::' separators to directory separators ('/'). This mechanism fails to act as a security boundary, allowing an attacker to escape the intended directory scope using '../' sequences.\nThe attack flow typically proceeds as follows: An attacker identifies an application interface that allows influence over DBI connection parameters, such as a DSN string or a backend configuration. The attacker constructs a malicious DSN, for instance: 'dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm'. Upon calling DBI->connect(), the driver receives these attributes. The DBD::DBM component then invokes 'require' on the unsanitized path. The Perl interpreter resolves this path and executes the file-scope code contained within the targeted file.\nThe impact is magnified by the behavior of components like DBI::Gofer and DBI::ProxyServer. DBI::Gofer forwards connect attributes to a server-side process, while DBI::ProxyServer performs superficial validation that only checks for driver prefixes, failing to inspect the potentially malicious attributes themselves. Consequently, an attacker can leverage these components to execute code in remote, higher-privilege, or cross-network contexts.\nThis vulnerability affects all versions of DBI prior to 1.653. Exploitation does not require prior authentication to the DBI layer itself, provided the application allows untrusted input to reach the connection attribute handling logic. Post-exploitation impact results in code execution with the permissions of the Perl interpreter, allowing for data exfiltration, service disruption, or further system exploitation."
}