Executive brief
MariaDB is a widely used database server for storing and managing digital information. A security flaw allowed users with low-level access to write data to files on the server's storage without the required administrative permissions. While this could potentially be used to fill up disk space or interfere with system operations, existing security settings like 'secure-file-priv' may limit the impact.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in MariaDB Server's privilege system. The server fails to verify the FILE privilege when a user executes a SELECT ... INTO OUTFILE or SELECT ... INTO DUMPFILE statement, provided the FROM clause contains only subqueries (derived tables). This allows an authenticated user with low privileges to write data to the server's filesystem, potentially leading to a denial-of-service condition via disk exhaustion. The vulnerability is mitigated if the --secure-file-priv option is enabled or if operating system-level permissions restrict the database process's write access. Patches are available in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Affected products
- MariaDB MariaDB Server 10.6.1 to 10.6.25, 10.11.1 to 10.11.16, 11.4.1 to 11.4.10, 11.8.1 to 11.8.6, 12.3.1
Timeline
- 2026-04-29: other: Issue reported in MariaDB Jira (MDEV-39493)
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD