Description
MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MariaDB | MariaDB | 11.8.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mariadb | 1:11.8.5-1 | — |
| Debian 13 | mariadb | 11.8.6-0+deb13u1 | — |
| Debian 12 | mariadb | 1:10.11.18-0+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | mariadb | No fix yet | — |
| Ubuntu 24.04 LTS | mariadb | No fix yet | — |
| Ubuntu 22.04 LTS | mariadb-10.6 | No fix yet | — |
| Ubuntu 20.04 LTS | mariadb-10.3 | No fix yet | — |
| Ubuntu 18.04 LTS | mariadb-10.1 | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | mariadb-10.0 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | mariadb +15 | 3:10.11.15-1.el10_1 | RHSA-2026:0136 |
| RHEL 9 | galera | 26.4.20-1.module+el9.5.0+22578+dc54e53f | RHSA-2026:0247 |
| RHEL 9 | mariadb +13 | 3:10.5.29-3.el9_7 | RHSA-2026:0247, RHSA-2026:0137 |
| RHEL 8 | Judy +1 | 1.0.5-18.module+el8.9.0+19449+ad5852d3 | RHSA-2026:0698, RHSA-2026:0233, RHSA-2026:0232 |
| RHEL 8 | asio +1 | 1.10.8-7.module+el8.9.0+19449+ad5852d3 | RHSA-2026:0698 |
| RHEL 8 | galera | 25.3.37-1.module+el8.9.0+19449+ad5852d3 | RHSA-2026:0698, RHSA-2026:0233, RHSA-2026:0232 |
| RHEL 8 | mariadb +12 | 3:10.3.39-2.module+el8.10.0+23756+5eac0e54 | RHSA-2026:0698, RHSA-2026:0233, RHSA-2026:0232 |
| RHEL 8 | mariadb-pam | 3:10.5.29-3.module+el8.10.0+23752+7ef55629 | RHSA-2026:0233, RHSA-2026:0232 |
Show 15 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | mariadb +15 | 3:10.11.15-1.el10_0 | RHSA-2026:0376 |
| RHEL 9.6 EUS | galera | 26.4.20-1.module+el9.5.0+22578+dc54e53f | RHSA-2026:0334 |
| RHEL 9.6 EUS | mariadb +13 | 3:10.5.29-3.el9_6 | RHSA-2026:0334, RHSA-2026:0111 |
| RHEL 9.4 EUS | galera | 26.4.16-1.module+el9.4.0+21205+b026b850 | RHSA-2026:0335 |
| RHEL 9.4 EUS | mariadb +13 | 3:10.5.22-2.el9_4 | RHSA-2026:0335, RHSA-2026:0061 |
| RHEL 9.2 E4S | mariadb +10 | 3:10.5.22-2.el9_2 | RHSA-2026:0112 |
| RHEL 9.0 E4S | mariadb +10 | 3:10.5.22-1.el9_0.1 | RHSA-2026:0351 |
| RHEL 8.8 TUS | Judy | 1.0.5-18.module+el8.4.0+9031+9abc7af9 | RHSA-2026:0296, RHSA-2026:0295 |
| RHEL 8.8 TUS | galera | 25.3.37-1.module+el8.8.0+19444+aac3c36b | RHSA-2026:0296, RHSA-2026:0295 |
| RHEL 8.8 TUS | mariadb +12 | 3:10.3.39-4.module+el8.8.0+23827+92695e7c | RHSA-2026:0296, RHSA-2026:0295 |
| RHEL 8.8 TUS | mariadb-pam | 3:10.5.22-2.module+el8.8.0+23802+124431be | RHSA-2026:0295 |
| RHEL 8.8 E4S | Judy | 1.0.5-18.module+el8.4.0+9031+9abc7af9 | RHSA-2026:0296, RHSA-2026:0295 |
| RHEL 8.8 E4S | galera | 25.3.37-1.module+el8.8.0+19444+aac3c36b | RHSA-2026:0296, RHSA-2026:0295 |
| RHEL 8.8 E4S | mariadb +12 | 3:10.3.39-4.module+el8.8.0+23827+92695e7c | RHSA-2026:0296, RHSA-2026:0295 |
| RHEL 8.8 E4S | mariadb-pam | 3:10.5.22-2.module+el8.8.0+23802+124431be | RHSA-2026:0295 |
| RHEL 8.6 TUS | Judy | 1.0.5-18.module+el8.4.0+9031+9abc7af9 | RHSA-2026:0344, RHSA-2026:0304 |
| RHEL 8.6 TUS | galera | 25.3.35-1.module+el8.6.0+15949+4ba4ec26 | RHSA-2026:0344, RHSA-2026:0304 |
| RHEL 8.6 TUS | mariadb +12 | 3:10.3.35-2.module+el8.6.0+23817+0c0bfeb4 | RHSA-2026:0344, RHSA-2026:0304 |
| RHEL 8.6 TUS | mariadb-pam | 3:10.5.22-2.module+el8.6.0+23818+e40eb7e6 | RHSA-2026:0344 |
| RHEL 8.6 E4S | Judy | 1.0.5-18.module+el8.4.0+9031+9abc7af9 | RHSA-2026:0344, RHSA-2026:0304 |
| RHEL 8.6 E4S | galera | 25.3.35-1.module+el8.6.0+15949+4ba4ec26 | RHSA-2026:0344, RHSA-2026:0304 |
| RHEL 8.6 E4S | mariadb +12 | 3:10.3.35-2.module+el8.6.0+23817+0c0bfeb4 | RHSA-2026:0344, RHSA-2026:0304 |
| RHEL 8.6 E4S | mariadb-pam | 3:10.5.22-2.module+el8.6.0+23818+e40eb7e6 | RHSA-2026:0344 |
| RHEL 8.6 AUS | Judy | 1.0.5-18.module+el8.4.0+9031+9abc7af9 | RHSA-2026:0344, RHSA-2026:0304 |
| RHEL 8.6 AUS | galera | 25.3.35-1.module+el8.6.0+15949+4ba4ec26 | RHSA-2026:0344, RHSA-2026:0304 |
| RHEL 8.6 AUS | mariadb +12 | 3:10.3.35-2.module+el8.6.0+23817+0c0bfeb4 | RHSA-2026:0344, RHSA-2026:0304 |
| RHEL 8.6 AUS | mariadb-pam | 3:10.5.22-2.module+el8.6.0+23818+e40eb7e6 | RHSA-2026:0344 |
| RHEL 8.4 EUS Long Life | Judy | 1.0.5-18.module+el8.4.0+9031+9abc7af9 | RHSA-2026:0336, RHSA-2026:0333 |
| RHEL 8.4 EUS Long Life | galera | 25.3.34-4.module+el8.4.0+15058+0c3d11c7 | RHSA-2026:0336, RHSA-2026:0333 |
| RHEL 8.4 EUS Long Life | mariadb +12 | 3:10.3.32-3.module+el8.4.0+23808+e07e6ffa | RHSA-2026:0336, RHSA-2026:0333 |
| RHEL 8.4 EUS Long Life | mariadb-pam | 3:10.5.22-3.module+el8.4.0+23847+f2036569 | RHSA-2026:0336 |
| RHEL 8.4 AUS | Judy | 1.0.5-18.module+el8.4.0+9031+9abc7af9 | RHSA-2026:0336, RHSA-2026:0333 |
| RHEL 8.4 AUS | galera | 25.3.34-4.module+el8.4.0+15058+0c3d11c7 | RHSA-2026:0336, RHSA-2026:0333 |
| RHEL 8.4 AUS | mariadb +12 | 3:10.3.32-3.module+el8.4.0+23808+e07e6ffa | RHSA-2026:0336, RHSA-2026:0333 |
| RHEL 8.4 AUS | mariadb-pam | 3:10.5.22-3.module+el8.4.0+23847+f2036569 | RHSA-2026:0336 |
| RHEL 8.2 AUS | Judy | 1.0.5-18.module+el8+2765+cfa4f87b | RHSA-2026:0357 |
| RHEL 8.2 AUS | galera | 25.3.32-1.module+el8.2.0+10474+c7510d9c | RHSA-2026:0357 |
| RHEL 8.2 AUS | mariadb +12 | 3:10.3.28-2.module+el8.2.0+23809+9df5005f | RHSA-2026:0357 |
| RHEL 7 ELS | mariadb +7 | 1:5.5.68-1.el7_9.1 | RHSA-2026:0367 |
| Red Hat Hardened Images 1 | mariadb10.11 +19 | 10.11.16-2.2.hum1 | RHSA-2026:8812 |
| Red Hat Hardened Images 1 | mariadb11.8 | 11.8.6-2.2.hum1 | RHSA-2026:8813 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | mariadb-common +1 | 3:10.11.15-1.el10_1 | ALSA-2026:0136 |
| AlmaLinux 9 | galera | 26.4.20-1.module_el9.5.0+135+c9657a87 | ALSA-2026:0247 |
| AlmaLinux 9 | mariadb +13 | 3:10.5.29-3.el9_7 | ALSA-2026:0247, ALSA-2026:0137 |
| AlmaLinux 8 | Judy | 1.0.5-18.module_el8.6.0+2867+72759d2f | ALSA-2026:0233, ALSA-2026:0232, ALSA-2026:0225 |
| AlmaLinux 8 | galera | 25.3.37-1.module_el8.8.0+3609+204d4ab0 | ALSA-2026:0233, ALSA-2026:0232, ALSA-2026:0225 |
| AlmaLinux 8 | mariadb +12 | 3:10.3.39-2.module_el8.10.0+4093+5130acef | ALSA-2026:0233, ALSA-2026:0232, ALSA-2026:0225 |
| AlmaLinux 8 | mariadb-pam | 3:10.5.29-3.module_el8.10.0+4094+f90dcfa6 | ALSA-2026:0233, ALSA-2026:0232 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | mariadb10.11 | 3:10.11.15-1.el10_1 | RLSA-2026:0136 |
| Rocky Linux 9 | galera | 26.4.20-1.module+el9.7.0+40024+12a6f3b4 | RLSA-2026:0247 |
| Rocky Linux 9 | mariadb | 3:10.5.29-3.el9_7 | RLSA-2026:0247, RLSA-2026:0137 |
| Rocky Linux 8 | Judy | 1.0.5-18.module+el8.4.0+427+adf35707 | RLSA-2026:0233, RLSA-2026:0232, RLSA-2026:0225 |
| Rocky Linux 8 | asio | 1.10.8-7.module+el8.5.0+777+18007c86 | RLSA-2026:0698 |
| Rocky Linux 8 | galera | 25.3.37-1.module+el8.8.0+1452+2a7eab68 | RLSA-2026:0233, RLSA-2026:0232, RLSA-2026:0225 |
| Rocky Linux 8 | mariadb | 3:10.3.39-2.module+el8.10.0+40062+b4bfe4b1 | RLSA-2026:0233, RLSA-2026:0232, RLSA-2026:0225 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | mariadb | 11.8.5-150700.3.9.1 | SUSE-SU-2025:4438-1 |
| SLES 15 SP6 | mariadb | 10.11.15-150600.4.17.1 | SUSE-SU-2025:4502-1 |
| SLES 15 SP5 | mariadb | 10.6.24-150400.3.43.1 | SUSE-SU-2025:4493-1 |
| SLES 15 SP4 | mariadb | 10.6.24-150400.3.43.1 | SUSE-SU-2025:4493-1 |
| SLES 15 SP3 | mariadb | 10.5.29-150300.3.55.1 | SUSE-SU-2025:4491-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | mariadb | 10.2.44-3.56.1 | SUSE-SU-2025:4520-1 |
| SLES for SAP 16.0 | mariadb | 11.8.5-160000.1.1 | SUSE-SU-2026:20018-1 |
| SLES for SAP 15 SP6 | mariadb | 10.11.15-150600.4.17.1 | SUSE-SU-2025:4502-1 |
| SLES for SAP 15 SP5 | mariadb | 10.6.24-150400.3.43.1 | SUSE-SU-2025:4493-1 |
| SLES for SAP 15 SP4 | mariadb | 10.6.24-150400.3.43.1 | SUSE-SU-2025:4493-1 |
| SLES for SAP 15 SP3 | mariadb | 10.5.29-150300.3.55.1 | SUSE-SU-2025:4491-1 |
| SLES 16.0 | mariadb | 11.8.5-160000.1.1 | SUSE-SU-2026:20018-1 |
| SLE HPC 15 SP5 | mariadb | 10.6.24-150400.3.43.1 | SUSE-SU-2025:4493-1 |
| SLE HPC 15 SP4 | mariadb | 10.6.24-150400.3.43.1 | SUSE-SU-2025:4493-1 |
| SLE HPC 15 SP3 | mariadb | 10.5.29-150300.3.55.1 | SUSE-SU-2025:4491-1 |
| SUSE Manager Server LTS 4.3 | mariadb | 10.6.24-150400.3.43.1 | SUSE-SU-2025:4493-1 |
| SUSE Manager Proxy LTS 4.3 | mariadb | 10.6.24-150400.3.43.1 | SUSE-SU-2025:4493-1 |
| SUSE Enterprise Storage 7.1 | mariadb | 10.5.29-150300.3.55.1 | SUSE-SU-2025:4491-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | mariadb | 11.8.5-160000.1.1 | openSUSE-SU-2025:20175-1 |
| openSUSE Leap 15.6 | mariadb | 10.11.15-150600.4.17.1 | SUSE-SU-2025:4502-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | mariadb1011 +15 | 3:10.11.15-1.amzn2023.0.1 | ALAS2023-2025-1331 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | mariadb | 10.11.15-1 | — |
| Azure Linux 2 (CBL-Mariner) | mariadb | 10.6.24-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | mariadb +14 | 3:10.11.15-1.el10_1 | ELSA-2026-0136 |
| Oracle Linux 9 | galera | 26.4.20-1.0.1.module+el9.5.0+90507+82ceef20 | ELSA-2026-0247 |
| Oracle Linux 9 | mariadb +13 | 3:10.5.29-3.el9_7 | ELSA-2026-0247, ELSA-2026-0137 |
| Oracle Linux 8 | Judy | 1.0.5-18.module+el8.10.0+90697+4b5f4cdd | ELSA-2026-0698, ELSA-2026-0233, ELSA-2026-0232 |
| Oracle Linux 8 | Judy-devel | 1.0.5-18.0.1.module+el8.3.0+9616+7a81225f | ELSA-2026-0698 |
| Oracle Linux 8 | asio-devel | 1.10.8-7.module+el8.1.0+5402+691bd77e | ELSA-2026-0698 |
| Oracle Linux 8 | galera | 25.3.37-1.module+el8.8.0+21165+f6462f70 | ELSA-2026-0698, ELSA-2026-0233, ELSA-2026-0232 |
| Oracle Linux 8 | mariadb +12 | 3:10.3.39-2.module+el8.10.0+90757+0fe265ac | ELSA-2026-0698, ELSA-2026-0233, ELSA-2026-0232 |
| Oracle Linux 8 | mariadb-pam | 3:10.5.29-3.module+el8.10.0+90755+6f9a2a8c | ELSA-2026-0233, ELSA-2026-0232 |
| Oracle Linux 7 | mariadb +7 | 1:5.5.68-1.0.1.el7 | ELSA-2026-0367 |
Advisories 50
- ALSA-2026:0136 Important: mariadb10.11 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:0247 Important: mariadb:10.11 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:0137 Important: mariadb security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:0225 Important: mariadb:10.3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:0232 Important: mariadb:10.11 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:0233 Important: mariadb:10.5 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:0376 Red Hat Security Advisory: mariadb10.11 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:0335 Red Hat Security Advisory: mariadb:10.11 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:0334 Red Hat Security Advisory: mariadb:10.11 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:0247 Red Hat Security Advisory: mariadb:10.11 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:0136 Red Hat Security Advisory: mariadb10.11 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:8813 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:8812 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:0698 Red Hat Security Advisory: mariadb-devel:10.3 security update Red Hat Security Advisories (RHSA) · Jul 9, 2026
- RHSA-2026:0357 Red Hat Security Advisory: mariadb:10.3 security update Red Hat Security Advisories (RHSA) · Jul 9, 2026
- RHSA-2026:0367 Red Hat Security Advisory: mariadb security update Red Hat Security Advisories (RHSA) · Jul 9, 2026
- RHSA-2026:0351 Red Hat Security Advisory: mariadb security update Red Hat Security Advisories (RHSA) · Jul 9, 2026
- RHSA-2026:0344 Red Hat Security Advisory: mariadb:10.5 security update Red Hat Security Advisories (RHSA) · Jul 9, 2026
- RHSA-2026:0336 Red Hat Security Advisory: mariadb:10.5 security update Red Hat Security Advisories (RHSA) · Jul 9, 2026
- RHSA-2026:0333 Red Hat Security Advisory: mariadb:10.3 security update Red Hat Security Advisories (RHSA) · Jul 9, 2026
- RHSA-2026:0296 Red Hat Security Advisory: mariadb:10.3 security update Red Hat Security Advisories (RHSA) · Jul 9, 2026
- RHSA-2026:0304 Red Hat Security Advisory: mariadb:10.3 security update Red Hat Security Advisories (RHSA) · Jul 9, 2026
- RHSA-2026:0295 Red Hat Security Advisory: mariadb:10.5 security update Red Hat Security Advisories (RHSA) · Jul 9, 2026
- RHSA-2026:0233 Red Hat Security Advisory: mariadb:10.5 security update Red Hat Security Advisories (RHSA) · Jul 9, 2026
- RHSA-2026:0232 Red Hat Security Advisory: mariadb:10.11 security update Red Hat Security Advisories (RHSA) · Jul 9, 2026
- RHSA-2026:0225 Red Hat Security Advisory: mariadb:10.3 security update Red Hat Security Advisories (RHSA) · Jul 9, 2026
- RHSA-2026:0137 Red Hat Security Advisory: mariadb security update Red Hat Security Advisories (RHSA) · Jul 9, 2026
- RHSA-2026:0111 Red Hat Security Advisory: mariadb security update Red Hat Security Advisories (RHSA) · Jul 9, 2026
- RHSA-2026:0112 Red Hat Security Advisory: mariadb security update Red Hat Security Advisories (RHSA) · Jul 9, 2026
- RHSA-2026:0061 Red Hat Security Advisory: mariadb security update Red Hat Security Advisories (RHSA) · Jul 9, 2026
- ALAS2023-2025-1331 Moderate: mariadb1011 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 31, 2026
- openSUSE-SU-2025:20175-1 Security update for mariadb SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20018-1 Security update for mariadb SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4491-1 Security update for mariadb SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4493-1 Security update for mariadb SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4520-1 Security update for mariadb SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4438-1 Security update for mariadb SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4502-1 Security update for mariadb SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-2694 MariaDB: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jan 28, 2026
- ELSA-2026-0367 Important: mariadb security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 28, 2026
- ELSA-2026-0698 Important: mariadb-devel:10.3 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 20, 2026
- RLSA-2026:0698 Important: mariadb-devel:10.3 security update Rocky Linux Security Advisories · Jan 16, 2026
- RLSA-2026:0233 Important: mariadb:10.5 security update Rocky Linux Security Advisories · Jan 9, 2026
- RLSA-2026:0247 Important: mariadb:10.11 security update Rocky Linux Security Advisories · Jan 9, 2026
- RLSA-2026:0136 Important: mariadb10.11 security update Rocky Linux Security Advisories · Jan 9, 2026
- RLSA-2026:0225 Important: mariadb:10.3 security update Rocky Linux Security Advisories · Jan 9, 2026
- RLSA-2026:0232 Important: mariadb:10.11 security update Rocky Linux Security Advisories · Jan 9, 2026
- ELSA-2026-0247 Important: mariadb:10.11 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jan 9, 2026
- ELSA-2026-0225 Important: mariadb:10.3 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 8, 2026
- RLSA-2026:0137 Important: mariadb security update Rocky Linux Security Advisories · Jan 7, 2026
References
- ZDI-25-1025
- vendor-provided URL vendor-advisory