CVE-2026-78030 is a critical code injection vulnerability affecting DBI versions before 1.653 for Perl, disclosed on 19 September 2026 by the CPAN Security Group. The flaw arises from the DBD::DBM component's failure to validate the dbm_type and dbm_mldbm attributes before passing them to Perl's require function, allowing arbitrary module loading.
The vulnerability permits remote code injection without requiring local access, making any Perl application that exposes these DBD::DBM parameters to attacker-controlled input a viable target. At the time of disclosure, no public exploit has been observed, though the attack vector is remotely exploitable and the mechanics are straightforward once an attacker identifies an exposed interface.
The CPAN Security Group has coordinated the disclosure alongside the release of DBI 1.653, which addresses the flaw. Administrators running affected Perl environments are advised to upgrade immediately, as the simplicity of the underlying issue raises the likelihood that working exploits will emerge in the near term.
Each brief contains detailed narrative, impact assessments, technical analysis, IOCs and response recommendations, all available inside the Deltabridge platform.
We use analytics cookies to understand how visitors use Deltabridge and improve the site. They’re off until you accept. See our Privacy Policy.