{"id":"CVE-2026-107814","published":"2026-10-09T16:17:26.150","lastModified":"2026-10-14T14:12:32.080","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-732"],"vendors":["mariadb"],"products":["mariadb"],"references":[{"url":"https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","tags":["Patch"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw","tags":["Vendor Advisory"]}],"exploitRefs":[{"url":"https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","tags":["Patch"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","tags":["Release Notes"]},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw","tags":["Vendor Advisory"]}],"hasPoc":true,"ai":{"summary":"MariaDB servers with RPM packages created a dedicated mysql service account with the database data directory as its home directory. A database user with FILE privilege could write startup dot-files into this home directory, which would execute when administrators opened login shells for the mysql account, potentially allowing privilege escalation. This affects versions from 10.6.1 through 10.6.27, 10.11.18, 11.4.12, 11.8.8, 12.3.2, and 13.0.1.","exploitability":"Exploitation requires a database user with FILE privilege to write malicious dot-files into the mysql account's home directory, which then execute when an admin opens a login shell for that account; this is moderately difficult but possible with proper access.","blast_radius":"The impact could be significant if attackers can leverage this to gain elevated privileges on the database server, potentially leading to full system compromise through the mysql service account.","remediation":"Upgrade to MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 to fix the issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","file-write","database"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:56:37.537Z"}}