CVE-2026-44173: MariaDB FILE Privilege Bypass via Subquery-Based SELECT

Technical summary

The vulnerability resides in MariaDB's permission-checking logic for file-output operations. Versions 10.6.1–10.6.25, 10.11.1–10.11.16, 11.4.1–11.4.10, 11.8.1–11.8.6, and 12.3.1 fail to validate FILE privilege when processing SELECT ... INTO OUTFILE or SELECT ... INTO DUMPFILE queries whose FROM clause contains exclusively subqueries (no direct table references). This omission allows any authenticated database user to execute file-write operations that should be restricted to privileged accounts. The root cause involves improper privilege verification during query compilation when subqueries obscure the underlying table access patterns.

Business impact

Organizations running vulnerable MariaDB instances face insider threats and credential-compromise scenarios where unprivileged database users can write files to the host operating system. Depending on file placement and web server configuration, an attacker could overwrite application files, inject malicious code into web roots, or corrupt system binaries. This escalates the impact of database account compromise from read-only or limited-write attacks to full system control in some environments. The vulnerability is particularly concerning in shared hosting and multi-tenant deployments where database segregation is relied upon.

Affected systems

MariaDB Community Server versions 10.6.1 through 10.6.25, 10.11.1 through 10.11.16, 11.4.1 through 11.4.10, 11.8.1 through 11.8.6, and 12.3.1 are affected. Patched versions are 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2. Users on version 10.5 and earlier, or 10.7–11.3 stable branches are not affected. Verify your installed version against MariaDB's release documentation.

Exploitability

Exploitation requires valid database credentials and login access to the MariaDB instance—no network exploit exists for unauthenticated attackers. The attack is deterministic: any user with SELECT privilege but without FILE privilege can craft the subquery-based SELECT statement to write files. No special exploitation tools or complex techniques are needed beyond standard SQL. The attack surface is moderate in internet-facing deployments but significant in environments where former employees or third-party vendors retain database access.

Remediation

Upgrade affected MariaDB installations to patched versions immediately: 10.6.26 or later for the 10.6 branch, 10.11.17 or later for 10.11, 11.4.11 or later for 11.4, 11.8.7 or later for 11.8, or 12.3.2 or later for 12.3. Verify the patch version against the official MariaDB release notes. Until patching is complete, restrict FILE privilege to only accounts that genuinely require it, and audit all user accounts to minimize the blast radius if credentials are compromised.

Patch guidance

Apply updates from the official MariaDB repository or your distribution's package manager. The fix involves restoring privilege checks for all variants of INTO OUTFILE and INTO DUMPFILE, including queries with subquery-only FROM clauses. Test patches in a non-production environment first, particularly if you rely on SELECT...INTO for legitimate administrative tasks. No breaking changes are expected—the patch simply re-enforces intended access control semantics. Review and update any backup or ETL scripts that may rely on privileged accounts performing these operations.

Detection guidance

Monitor MariaDB audit logs (if enabled) for SELECT statements containing INTO OUTFILE or INTO DUMPFILE, especially from low-privilege users. Enable the general query log temporarily to capture suspicious patterns, then filter for accounts attempting file-write operations. Check file system integrity on paths typically used for database exports (e.g., /var/lib/mysql/, /tmp/). Correlate database login events with unexpected file creation or modification timestamps. Network segmentation and firewalls should limit database access to trusted application servers only.

Why prioritize this

Although the CVSS score is moderate (5.0), the contextual risk is elevated because successful exploitation directly translates to filesystem write access—a stepping stone to remote code execution or data destruction. The requirement for valid credentials lowers immediate risk in air-gapped environments but increases risk anywhere database credentials are shared, leaked, or accessible to third parties. Patching should be prioritized in production environments, particularly if the MariaDB instance is co-hosted with web applications or other critical services.

Risk score, explained

The CVSS:3.1 score of 5.0 (MEDIUM) reflects low attack complexity, requirement for authenticated access, and no direct confidentiality impact. However, the integrity impact (ability to write arbitrary files) and the potential for scope escalation (filesystem control can affect other services) justify immediate patching. The score does not capture the privilege-escalation dimension fully; organizations should weight their own threat model, credential hygiene, and infrastructure segmentation when determining patch urgency.

Frequently asked questions