CVE-2026-44171: MariaDB mbstream Path Traversal Vulnerability – Patches Available

Technical summary

The vulnerability stems from insufficient path validation in mbstream, the streaming backup component of MariaDB. When unpacking backup archives, the tool fails to detect and reject path traversal sequences (/../) that could redirect file extraction outside the specified target directory. This is a classic CWE-22 path traversal flaw. While legitimate MariaDB backups would never contain such sequences, a crafted archive could exploit this gap to place files in arbitrary locations with the privileges of the user running mbstream. The issue has been remediated in patched versions by implementing proper path validation before file extraction.

Business impact

Organizations relying on MariaDB backups face a risk of unauthorized file placement on database servers if untrusted or compromised backup archives are processed. This could enable attackers to overwrite system files, inject malicious code, or escalate privileges. The impact is most acute in environments where backup files are received from external sources or where backup processes are automated without strict integrity verification. Incident response and forensics teams may face challenges if backup restoration inadvertently implants persistent threats.

Affected systems

Affected MariaDB versions include: 10.6.1 through 10.6.25, 10.11.1 through 10.11.16, 11.4.1 through 11.4.10, 11.8.1 through 11.8.6, and 12.3.1. Patches are available in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2. Verify your installed version and apply the corresponding patch release. Systems not using mbstream for backup operations are not affected by this specific issue.

Exploitability

Exploitation requires local system access and high privileges (the ability to run or influence mbstream execution). The attack vector is local, and successful exploitation depends on user interaction—the attacker must provide or trick the system into processing a malicious backup file. The CVSS 3.1 score of 6.3 (MEDIUM) reflects these constraints. While not easily exploitable from the network, the vulnerability is practical for insider threats or post-compromise lateral movement scenarios where an attacker has foothold access and seeks to escalate or persist.

Remediation

Upgrade to the patched versions: 10.6.26 or later, 10.11.17 or later, 11.4.11 or later, 11.8.7 or later, or 12.3.2 or later, depending on your current branch. Additionally, implement integrity verification for backup files (e.g., cryptographic signatures or checksums) before processing, limit who can initiate backup restoration operations, and avoid processing backup archives from untrusted sources. Monitor backup restoration logs for unusual file paths or extraction errors.

Patch guidance

Review your MariaDB version against the affected ranges listed in the source data. Plan upgrades within your maintenance windows, testing patches in non-production environments first. For organizations on extended support branches (10.6 LTS), patches are available in 10.6.26. Organizations on 10.11, 11.4, 11.8, or 12.3 should verify patch availability in their subscription or distribution channel. Upgrade prioritization should reflect your backup frequency and whether external backup files are processed.

Detection guidance

Monitor mbstream execution and backup restoration processes. Log all invocations of mbstream, particularly any that process backup files from external or less-trusted sources. Watch for error messages indicating invalid or suspicious paths during archive extraction. Filesystem auditing tools (e.g., auditd on Linux) can flag unexpected file creation events in system directories during backup operations. Review backup file sources and implement pre-extraction validation steps to reject files with suspicious path components. Security information and event management (SIEM) integration of backup logs can help detect patterns consistent with exploitation attempts.

Why prioritize this

Although the CVSS score is MEDIUM, organizations should prioritize this patch based on their backup architecture. Those frequently restoring external backups, maintaining production MariaDB databases, or operating in compliance-sensitive environments should move this to near-term remediation. The path traversal mechanism is well-understood and patched; the main risk is delayed patching in environments where backup restoration is routine. Conversely, organizations that rarely restore backups or that only process internally-generated, cryptographically verified backup files may defer this to standard quarterly patching cycles.

Risk score, explained

The CVSS 3.1 score of 6.3 (MEDIUM) is justified by the local attack vector, high privilege requirement, and user interaction dependency. However, the impact rating reflects high consequences if exploited (confidentiality, integrity, and availability all affected at the system level). The score does not account for the relative rarity of path traversal exploitation in backup utilities or mitigating factors such as the ease of detecting unusual file placements. Organizations should consider their specific risk context—backup frequency, file sources, and operational controls—when determining internal severity.

Frequently asked questions