Skip to content

GHSA-wqmw-wqwx-3fr7 on Cyberus Linux 26.05

Aliases: GHSA-wqmw-wqwx-3fr7, CVE-2026-78030

Packages: perlPackages.DBI

Status: Plausible

Advisory Information

DBD::DBM (bundled in DBI) takes the dbm_type and dbm_mldbm connect attributes and passes them into require() with no value-level validation in three sites. Lines 320-321 require() treats a path-shaped string as a literal file and never consults @INC, so the attribute value names the file Perl loads and runs the code. The "MLDBM::Serializer::" prefix on lines 191-195 is not a containment boundary: s|::|/|g rewrites only ::, a literal / in the value survives, and MLDBM installs MLDBM/Serializer/ into \@INC, so every component of a traversal out of it exists. The third path is the most reachable of the three and is easy to miss: lines 388-391 assigns the raw attribute to $MLDBM::Serializer, and MLDBM requires whatever that names (MLDBM.pm:108) on every read or write of an MLDBM-backed table, not just on the dbm_versions() diagnostic.

Trigger surface: any caller that lets a less-trusted party influence either attribute — a DSN fragment, a request parameter choosing a storage backend, config inherited from a lower tier.

Updates

2026-08-26 10:06 CEST

Metadata changes:

  • Status for package perlPackages.DBI: “Plausible”

2026-08-26 10:05 CEST

Metadata changes:

  • Status for package perlPackages.DBI: “New”