← Back

CVE-2026-44171

nvd nist
Published: Jun 12, 2026Modified: Jun 17, 2026

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

Affected (5)

Products: Mariadb: Mariadb
Mariadb
1 product
Mariadb
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Mariadb
Mariadb
From 10.11.1 to 10.11.17
Mariadb
From 10.6.1 to 10.6.26
Mariadb
From 11.4.1 to 11.4.11
Mariadb
From 11.8.1 to 11.8.7
Mariadb
Version 12.3.1

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (2)

Source: security-advisories@github.com
Vendor Advisory
Source: security-advisories@github.com
Issue TrackingThird Party Advisory

Timeline

No history available yet.