5.0Mittel

CVE-2026-44173MariaDB: FILE privilege was not checked for subqueries in the FROM clause

MariaDB server; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9 Veröffentlicht: (vor 5 Monaten)

Beschreibung

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

Schwachstellentyp (CWE): CWE-863CWE-266

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
mariadb mariadb 10.6.1 – < 10.6.26
MariaDB server >= 10.6.1, < 10.6.26, >= 10.11.1, < 10.11.17, >= 11.4.1, < 11.4.11, >= 11.8.1, < 11.8.7, >= 12.3.1, < 12.3.2
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 7 —
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Hardened Images all versions

Referenzen und Patches

CPE-Treffer (NVD) (5)

  • cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* ≥ 10.6.1 < 10.6.26
  • cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* ≥ 10.11.1 < 10.11.17
  • cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* ≥ 11.4.1 < 11.4.11
  • cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* ≥ 11.8.1 < 11.8.7
  • cpe:2.3:a:mariadb:mariadb:12.3.1:*:*:*:*:*:*:*