# CVE-2026-85985: MariaDB CONNECT engine file access bypass in JSON UDFs

Source: https://junglewise.ai/threats/cve-2026-85985-mariadb-server-is-a-community-developed-fork-of-mysql-server-from  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-85985 · Severity: medium · CVSS 5.4 · Published 2026-10-16

MariaDB's CONNECT engine is an optional plugin that provides access to various data formats including JSON files. Affected versions lack proper privilege checks in several file-access functions, allowing low-privileged database users to read or write arbitrary files that the database process can access, bypassing the FILE privilege and secure_file_priv restrictions.

Technologies: [MariaDB Server](https://junglewise.ai/threats/technologies/mariadb-mariadb-server). Vendors: [Mariadb](https://junglewise.ai/threats/vendors/mariadb).

## Quick answers

**Is CVE-2026-85985 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85985 being exploited in the wild.

**How severe is CVE-2026-85985?** Medium severity, with a CVSS score of 5.4, published 16 October 2026.

**Which products and versions are affected?** MariaDB Server 10.6.1 to 10.6.27, 10.11.0 to 10.11.18, 11.4.0 to 11.4.12, 11.8.0 to 11.8.8, 12.3.0 to 12.3.2, 13.0.0 to 13.0.1.

**Is there a fix for CVE-2026-85985?** Yes: fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85985 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-85985?** Check whether you run MariaDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2

## Technical details

The CONNECT engine's json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() user-defined functions fail to enforce FILE privilege or respect the secure_file_priv setting before accessing filesystem paths. An authenticated attacker with low privileges can call these UDFs with arbitrary file paths to read or write files outside the intended scope, limited only by operating-system permissions of the database account.

## Affected products

- MariaDB MariaDB Server 10.6.1 to 10.6.27, 10.11.0 to 10.11.18, 11.4.0 to 11.4.12, 11.8.0 to 11.8.8, 12.3.0 to 12.3.2, 13.0.0 to 13.0.1

## Timeline

- 2026-10-16: disclosed

## References

- [https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe](https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe)
- [https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19](https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19)

## Related threats

- [MariaDB ALTER TABLE filename encoding bypass in CONVERT PARTITION](https://junglewise.ai/threats/cve-2026-102523-mariadb-server-is-a-community-developed-fork-of-mysql-server)
- [MariaDB GRANT PROXY authorization bypass with empty password](https://junglewise.ai/threats/cve-2026-97380-mariadb-server-is-a-community-developed-fork-of-mysql-server-from)
- [MariaDB server table name encoding bypass via #mysql50# prefix](https://junglewise.ai/threats/cve-2026-92262-mariadb-server-is-a-community-developed-fork-of-mysql-server-from)
- [MariaDB SQL injection in SHOW CREATE and mariadb-dump](https://junglewise.ai/threats/cve-2026-86047-mariadb-server-is-a-community-developed-fork-of-mysql-server-from)
- [MariaDB use-after-free in SYS_REFCURSOR cursor handling](https://junglewise.ai/threats/cve-2026-85748-mariadb-server-is-a-community-developed-fork-of-mysql-server-from)