# CVE-2026-102523: MariaDB ALTER TABLE filename encoding bypass in CONVERT PARTITION

Source: https://junglewise.ai/threats/cve-2026-102523-mariadb-server-is-a-community-developed-fork-of-mysql-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-102523 · Severity: high · CVSS 8 · Published 2026-11-05

MariaDB is a widely-used open-source database server. An authenticated database user can exploit improper handling of partition names in the ALTER TABLE ... CONVERT ... PARTITION command to bypass access controls and read or modify table files they should not have permission to access. This could lead to unauthorized data exposure or corruption in multi-tenant database environments.

Technologies: [MariaDB Server](https://junglewise.ai/threats/technologies/mariadb-mariadb-server). Vendors: [Mariadb](https://junglewise.ai/threats/vendors/mariadb).

## Quick answers

**Is CVE-2026-102523 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102523 being exploited in the wild.

**How severe is CVE-2026-102523?** High severity, with a CVSS score of 8, published 5 November 2026.

**Which products and versions are affected?** MariaDB Server 10.11.1 through 10.11.18, 11.0.0 through 11.4.12, 11.5.0 through 11.8.8, 12.0.0 through 12.3.2, 13.0.0 through 13.0.1.

**Is there a fix for CVE-2026-102523?** Yes: fixed in MariaDB Server 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102523 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102523?** Check whether you run MariaDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in MariaDB Server 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2

## Technical details

The vulnerability exists in ALTER TABLE ... CONVERT ... PARTITION operations where user-supplied partition names are not properly filename-encoded before use in filesystem path construction. An authenticated attacker can craft partition names containing special characters (e.g., hyphens) that require escaping to access unauthorized table files on disk. The fix applies proper filename encoding to partition names during CONVERT operations.

## Affected products

- MariaDB MariaDB Server 10.11.1 through 10.11.18, 11.0.0 through 11.4.12, 11.5.0 through 11.8.8, 12.0.0 through 12.3.2, 13.0.0 through 13.0.1

## Timeline

- 2026-11-05: disclosed
- 2026-08-24: patched

## References

- [https://github.com/MariaDB/server/commit/98437c30ae52ed709f266e5f8095d779261a5879](https://github.com/MariaDB/server/commit/98437c30ae52ed709f266e5f8095d779261a5879)
- [https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19](https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19)

## Related threats

- [MariaDB GRANT PROXY authorization bypass with empty password](https://junglewise.ai/threats/cve-2026-97380-mariadb-server-is-a-community-developed-fork-of-mysql-server-from)
- [MariaDB server table name encoding bypass via #mysql50# prefix](https://junglewise.ai/threats/cve-2026-92262-mariadb-server-is-a-community-developed-fork-of-mysql-server-from)
- [MariaDB SQL injection in SHOW CREATE and mariadb-dump](https://junglewise.ai/threats/cve-2026-86047-mariadb-server-is-a-community-developed-fork-of-mysql-server-from)
- [MariaDB CONNECT engine file access bypass in JSON UDFs](https://junglewise.ai/threats/cve-2026-85985-mariadb-server-is-a-community-developed-fork-of-mysql-server-from)
- [MariaDB use-after-free in SYS_REFCURSOR cursor handling](https://junglewise.ai/threats/cve-2026-85748-mariadb-server-is-a-community-developed-fork-of-mysql-server-from)