Executive brief
A vulnerability exists in the MariaDB database backup utility, mbstream, which is used for processing database backup streams. An attacker could provide a malicious backup file that, when unpacked, writes files to unauthorized locations on the server's operating system. This could lead to a full system compromise, data loss, or service disruption if critical system files are overwritten.
Technical details
A path traversal vulnerability (CWE-22) exists in the mbstream utility within MariaDB Server. The root cause is a failure to sanitize or check for '/../' sequences in file paths when unpacking archives. An attacker with high privileges could exploit this by tricking a user into processing a specially crafted mbstream archive. Successful exploitation allows the attacker to create or overwrite files outside of the specified target directory, potentially leading to remote code execution or system instability. The issue is patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Affected products
- MariaDB MariaDB Server 10.6.1 to 10.6.25, 10.11.1 to 10.11.16, 11.4.1 to 11.4.10, 11.8.1 to 11.8.6, 12.3.1
Timeline
- 2026-04-22: other: Issue reported to MariaDB Jira
- 2026-04-27: patched: Issue resolved in development branch
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD