The vulnerability arises from DBD::DBM passing the dbm_type and dbm_mldbm connect attributes directly to Perl's require function without validating that the values correspond to safe module names. The require function treats path-shaped strings as literal filenames, allowing traversal outside the intended serializer directory. The MLDBM::Serializer:: prefix is not a security boundary, as path separators can be manipulated to escape the directory. If an attacker can control these attributes, for example via a DSN fragment, they can execute arbitrary code by loading malicious modules. DBD::Gofer forwards these attributes to the server side, and DBI::ProxyServer only verifies the DSN driver prefix, not the attribute values.

An attacker able to influence the dbm_type or dbm_mldbm attributes can cause the application to load and execute arbitrary Perl code, potentially leading to remote code execution or privilege escalation depending on the context in which the DBI connection is used. This compromises the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input to set dbm_type or dbm_mldbm attributes in DBD::DBM connections. Validate and sanitize any input that influences these attributes to ensure only safe module names are used. Consider restricting or disabling the use of DBD::DBM in environments where untrusted input cannot be controlled.