CVE-2026-85985
Fixed in a distro release EPSS <1%CVSS 5.4
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Products: MariaDB server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | mariadb | no fix |
| Debian 13 | mariadb | no fix |
| Debian 14 | mariadb | 1:11.8.9+ds-1 |
| Red Hat hummingbird 1 | mariadb10.11 | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-backup | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-client-utils | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-common | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-connect-engine | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-cracklib-password-check | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-devel | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-embedded | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-embedded-devel | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-errmsg | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-gssapi-server | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-oqgraph-engine | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-pam | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-rocksdb-engine | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-s3-engine | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-server | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-server-galera | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-server-utils | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-sphinx-engine | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb10.11-test | 0:10.11.18-4.1.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8 | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-backup | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-client-utils | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-common | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-connect-engine | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-cracklib-password-check | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-devel | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-duckdb-engine | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-embedded | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-embedded-devel | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-errmsg | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-gssapi-server | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-oqgraph-engine | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-pam | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-rocksdb-engine | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-s3-engine | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-server | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-server-galera | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-server-utils | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-sphinx-engine | 0:11.8.9-0.1.hum1 |
| Red Hat hummingbird 1 | mariadb11.8-test | 0:11.8.9-0.1.hum1 |
| Ubuntu 16.04 LTS | mariadb-10.0 | no fix |
| Ubuntu 18.04 LTS | mariadb-10.1 | no fix |
| Ubuntu 20.04 LTS | mariadb-10.3 | no fix |
| Ubuntu 22.04 LTS | mariadb-10.6 | no fix |
| Ubuntu 24.04 LTS | mariadb | no fix |
| Ubuntu 26.04 LTS | mariadb | no fix |
| Ubuntu 26.10 | mariadb | no fix |
| openSUSE Tumbleweed | mariadb | 12.3.2-3.1 |