CVE-2026-44171
Received Received - Intake
Path Traversal in MariaDB mbstream

Publication date: 2026-06-12

Last updated on: 2026-06-12

Assigner: GitHub, Inc.

Description
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-12
Last Modified
2026-06-12
Generated
2026-06-13
AI Q&A
2026-06-12
EPSS Evaluated
N/A
NVD
CVE-2026-44171
EUVD
EUVD-2026-36516
Affected Vendors & Products
Showing 16 associated CPEs
Vendor Product Version / Range
mariadb server From 12.3.1 (inc)
mariadb server 10.6
mariadb server 10.11
mariadb server 11.4
mariadb server 11.8
mariadb server 12.3
mariadb server From 10.6.1 (inc) to 10.6.26 (exc)
mariadb server From 10.11.1 (inc) to 10.11.17 (exc)
mariadb server From 11.4.1 (inc) to 11.4.11 (exc)
mariadb server From 11.8.1 (inc) to 11.8.7 (exc)
mariadb server 12.3.1
mariadb server to 10.6.26 (inc)
mariadb server to 10.11.17 (inc)
mariadb server to 11.4.11 (inc)
mariadb server to 11.8.7 (inc)
mariadb server 12.3.2
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Detection Guidance

This vulnerability involves the mbstream component of MariaDB improperly validating paths when unpacking archives, allowing files to be created outside the intended directory.

Detection would involve checking for usage of vulnerable MariaDB versions (10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1) and monitoring for suspicious mbstream archive unpacking activities that create files outside expected directories.

Specific commands are not provided in the available resources.

Executive Summary

CVE-2026-44171 is a path traversal vulnerability in the mbstream component of MariaDB. The issue occurs because mbstream fails to properly validate paths when unpacking archives, allowing specially crafted archives to create files outside the intended target directory.

This means that an attacker could craft an archive that, when unpacked by mbstream, causes files to be created or overwritten in locations outside the expected backup directory.

The vulnerability affects multiple MariaDB versions and has been patched in later releases.

Impact Analysis

This vulnerability can lead to unauthorized file creation or overwriting in sensitive locations on the system where MariaDB is running.

Such unauthorized file manipulation can compromise the confidentiality, integrity, and availability of the system.

Because the vulnerability requires high privileges and user interaction, an attacker with sufficient access could exploit it to alter critical files, potentially leading to system compromise or data loss.

Mitigation Strategies

The primary mitigation step is to upgrade MariaDB to a patched version where this vulnerability is fixed.

  • Upgrade to MariaDB versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, or 12.3.2 or later.
  • Avoid unpacking untrusted or specially crafted mbstream archives until the upgrade is applied.
  • Restrict mbstream usage to trusted users with appropriate privileges to reduce risk.
Compliance Impact

The vulnerability allows specially crafted archives to create or overwrite files outside the intended directory, potentially leading to unauthorized file creation or modification in sensitive locations.

Such unauthorized file operations could impact the confidentiality, integrity, and availability of data, which are critical aspects of compliance with standards like GDPR and HIPAA.

If exploited, this vulnerability might lead to data breaches or unauthorized data manipulation, thereby risking non-compliance with regulations that require strict data protection and integrity controls.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44171. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart