HarborGuardharborguardDatabase
Back to search
HIGHCVE-2026-44173Published Modified CNA GitHub_M

CVE-2026-44173: MariaDB: FILE privilege was not checked for subqueries in the FROM clause

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

Metrics

CVSS v3.1
8.1
Severity
HIGH
Fixed in
Affected Products
1

Get notified

Email me when this CVE is updated: new fix versions, severity changes, or any record change.

Affected packages
  • MariaDB / server
    >= 10.6.1, < 10.6.26 · >= 10.11.1, < 10.11.17 · >= 11.4.1, < 11.4.11 · >= 11.8.1, < 11.8.7 · >= 12.3.1, < 12.3.2
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H