CVE-2026-44173

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-25)

CWEs

CWE-863, CWE-266

Published

2026-06-12

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• mariadb:mariadb

References

• https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc
• https://jira.mariadb.org/browse/MDEV-39493
• https://access.redhat.com/errata/RHSA-2026:25143
• https://access.redhat.com/errata/RHSA-2026:25145
• https://access.redhat.com/errata/RHSA-2026:33093

Check your stackJSON