Arbitrary Module Loading in Perl DBI DBD::DBM

CVE-2026-78030 is a critical arbitrary code execution vulnerability in Perl's DBI module versions before 1.653, specifically in the DBD::DBM database driver. The flaw exists in how DBD::DBM handles the dbm_type and dbm_mldbm connect attributes, passing them directly to Perl's require function without validation. This allows attackers to specify arbitrary module paths that Perl will load and execute, effectively achieving remote code execution on any system using vulnerable DBI versions to connect to databases. The vulnerability affects any application or service built with Perl that uses DBI for database connectivity, making this a wide-reaching threat to legacy systems, system administration tools, and web applications built on Perl frameworks.

While Casky currently shows zero matching skills for this specific CVE, the attack pattern underlying this vulnerability falls within reconnaissance and code execution behaviors that practitioners should monitor. An attacker would need to control or influence database connection parameters—a scenario that maps to T1566 (Phishing) if delivered via social engineering of connection strings, or T1190 (Exploit Public-Facing Application) if the vulnerable DBI instance is exposed through a web interface. Detection would focus on unusual module loading attempts, suspicious require() calls with path traversal patterns, and unexpected process spawning from Perl interpreters. Practitioners using Casky should create custom detection rules monitoring for dbm_type and dbm_mldbm attribute usage patterns, unexpected file access from DBI processes, and any Perl process execution of non-standard modules—particularly those loaded from unexpected filesystem locations rather than standard @INC paths.