CVE-2026-107814
HighCVSS 8.4Summary
MariaDB server from 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, which could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home.
Risk Assessment
A database user with the FILE privilege can achieve code execution with mysql account privileges, potentially leading to privilege escalation and database server compromise.
Recommendation
Upgrade MariaDB to versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 and restrict granting of the FILE privilege to database users.
Other vulnerabilities in MariaDB Server
See all- CVE-2026-49261Critical
A vulnerability in MariaDB Server allows execution of arbitrary shell commands embedded in the joiner node name when `wsrep_notify_cmd` is enabled. Affected versions: 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1.
- CVE-2026-107817Medium
MariaDB server versions from 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 have a vulnerability in the mysql_json plugin that assumes imported MySQL tables contain valid binary JSON. A specially crafted table with invalid JSON can cause out-of-bounds reads, information disclosure, or server crash.
- CVE-2026-107816Medium
MariaDB server versions from 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 have a vulnerability in the qc_info plugin that can be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server.
- CVE-2026-107815High
MariaDB server from 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 contains a vulnerability in the CONNECT engine's DOS table type where an incorrect boundary check permits a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution.
- CVE-2026-44171Medium
MariaDB server versions from 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1 had an issue with not checking for /../ in the path when unpacking the archive. A specially crafted archive could have caused mbstream to create files outside of the target-dir path.
- CVE-2026-44169Medium
In MariaDB versions from 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user with EXECUTE access to a stored routine could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2.
- CVE-2026-35549Medium
In MariaDB Server before versions 11.4.10, 11.5.x-11.8.x before 11.8.6, and 12.x before 12.2.2, a vulnerability was found where a large packet can crash the server if the caching_sha2_password authentication plugin is installed and some user accounts are configured to use it. The issue is due to alloca usage in sha256_crypt_r.
Original NVD description (English source)
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS