CVE-2026-44173

Published: Jun 12, 2026Modified: Jun 12, 2026

5.0

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Exploitability: 3.1 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc

Source: security-advisories@github.com

https://jira.mariadb.org/browse/MDEV-39493

Source: security-advisories@github.com

Timeline

No history available yet.