Read the docs
TI-2025-12520 Aliases CVE-2025-13699GHSA-rqf2-8625-4vgv

Path traversal in MariaDB

Priority LOW 33CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and Red Hat.

Summary

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0052 44th percentileScored 2026-11-07
Fix Fixed Red Hat: 24 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MariaDBMariaDB11.8.3—No fix listedCNA
  • MariaDB VendorMariaDB Affected 11.8.3 Fixed in — No fix listed CNA

Remediation

Red Hat 24 advisories

  • RHSA-2026:8813 Released 2026-04-17 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images mariadb11.8-11.8.6-2.2.hum1@src
  • RHSA-2026:8812 Released 2026-04-17 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images mariadb10.11-10.11.16-2.2.hum1@aarch64, mariadb10.11-10.11.16-2.2.hum1@src, mariadb10.11-10.11.16-2.2.hum1@x86_64 +37
  • RHSA-2026:0698 Released 2026-01-15 · Red Hat rating Important
    mariadb-devel:10.3 security update
    • Red Hat Enterprise Linux CRB (v. 8) Judy-1.0.5-18.module+el8.9.0+19449+ad5852d3.i686::mariadb-devel:10.3, Judy-devel-1.0.5-18.module+el8.9.0+19449+ad5852d3.aarch64::mariadb-devel:10.3, Judy-devel-1.0.5-18.module+el8.9.0+19449+ad5852d3.i686::mariadb-devel:10.3 +23
Show 21 more Red Hat advisories
  • RHSA-2026:0304 Released 2026-01-09 · Red Hat rating Important
    mariadb:10.3 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) Judy-1.0.5-18.module+el8+2765+cfa4f87b.src::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.x86_64::mariadb:10.3, galera-25.3.35-1.module+el8.6.0+15949+4ba4ec26.src::mariadb:10.3 +15
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) Judy-1.0.5-18.module+el8+2765+cfa4f87b.aarch64::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.ppc64le::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.s390x::mariadb:10.3 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) Judy-1.0.5-18.module+el8+2765+cfa4f87b.src::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.x86_64::mariadb:10.3, galera-25.3.35-1.module+el8.6.0+15949+4ba4ec26.src::mariadb:10.3 +15
  • RHSA-2026:0376 Released 2026-01-08 · Red Hat rating Important
    mariadb10.11 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) mariadb-3:10.11.15-1.el10_0, mariadb-backup-3:10.11.15-1.el10_0, mariadb-client-utils-3:10.11.15-1.el10_0 +13
  • RHSA-2026:0367 Released 2026-01-08 · Red Hat rating Important
    mariadb security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) mariadb-1:5.5.68-1.el7_9.1, mariadb-bench-1:5.5.68-1.el7_9.1, mariadb-devel-1:5.5.68-1.el7_9.1 +5
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) mariadb-embedded-1:5.5.68-1.el7_9.1, mariadb-embedded-1:5.5.68-1.el7_9.1.ppc, mariadb-embedded-devel-1:5.5.68-1.el7_9.1 +1
  • RHSA-2026:0357 Released 2026-01-08 · Red Hat rating Important
    mariadb:10.3 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) Judy-1.0.5-18.module+el8+2765+cfa4f87b.src::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.x86_64::mariadb:10.3, galera-25.3.32-1.module+el8.2.0+10474+c7510d9c.src::mariadb:10.3 +15
  • RHSA-2026:0351 Released 2026-01-08 · Red Hat rating Important
    mariadb security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) mariadb-3:10.5.22-1.el9_0.1, mariadb-backup-3:10.5.22-1.el9_0.1, mariadb-common-3:10.5.22-1.el9_0.1 +8
  • RHSA-2026:0344 Released 2026-01-08 · Red Hat rating Important
    mariadb:10.5 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.src::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5, galera-26.4.14-1.module+el8.6.0+20274+5db7ad9f.src::mariadb:10.5 +16
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.aarch64::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.ppc64le::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.s390x::mariadb:10.5 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.src::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5, galera-26.4.14-1.module+el8.6.0+20274+5db7ad9f.src::mariadb:10.5 +16
  • RHSA-2026:0334 Released 2026-01-08 · Red Hat rating Important
    mariadb:10.11 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) galera-26.4.20-1.module+el9.5.0+22578+dc54e53f.aarch64::mariadb:10.11, galera-26.4.20-1.module+el9.5.0+22578+dc54e53f.ppc64le::mariadb:10.11, galera-26.4.20-1.module+el9.5.0+22578+dc54e53f.s390x::mariadb:10.11 +47
  • RHSA-2026:0335 Released 2026-01-08 · Red Hat rating Important
    mariadb:10.11 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) galera-26.4.16-1.module+el9.4.0+21205+b026b850.aarch64::mariadb:10.11, galera-26.4.16-1.module+el9.4.0+21205+b026b850.ppc64le::mariadb:10.11, galera-26.4.16-1.module+el9.4.0+21205+b026b850.s390x::mariadb:10.11 +47
  • RHSA-2026:0336 Released 2026-01-08 · Red Hat rating Important
    mariadb:10.5 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.src::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5, galera-26.4.14-1.module+el8.4.0+20291+fd32d29c.src::mariadb:10.5 +16
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.src::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5, galera-26.4.14-1.module+el8.4.0+20291+fd32d29c.src::mariadb:10.5 +16
  • RHSA-2026:0333 Released 2026-01-08 · Red Hat rating Important
    mariadb:10.3 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) Judy-1.0.5-18.module+el8+2765+cfa4f87b.src::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.x86_64::mariadb:10.3, galera-25.3.34-4.module+el8.4.0+15058+0c3d11c7.src::mariadb:10.3 +15
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) Judy-1.0.5-18.module+el8+2765+cfa4f87b.src::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.x86_64::mariadb:10.3, galera-25.3.34-4.module+el8.4.0+15058+0c3d11c7.src::mariadb:10.3 +15
  • RHSA-2026:0296 Released 2026-01-08 · Red Hat rating Important
    mariadb:10.3 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) Judy-1.0.5-18.module+el8+2765+cfa4f87b.ppc64le::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.src::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.x86_64::mariadb:10.3 +30
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) Judy-1.0.5-18.module+el8+2765+cfa4f87b.src::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.x86_64::mariadb:10.3, galera-25.3.37-1.module+el8.8.0+19444+aac3c36b.src::mariadb:10.3 +15
  • RHSA-2026:0295 Released 2026-01-08 · Red Hat rating Important
    mariadb:10.5 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.ppc64le::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.src::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5 +32
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.src::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5, galera-26.4.14-1.module+el8.8.0+20134+a92c7654.src::mariadb:10.5 +16
  • RHSA-2026:0247 Released 2026-01-07 · Red Hat rating Important
    mariadb:10.11 security update
    • Red Hat Enterprise Linux AppStream (v. 9) galera-26.4.20-1.module+el9.5.0+22578+dc54e53f.aarch64::mariadb:10.11, galera-26.4.20-1.module+el9.5.0+22578+dc54e53f.ppc64le::mariadb:10.11, galera-26.4.20-1.module+el9.5.0+22578+dc54e53f.s390x::mariadb:10.11 +47
  • RHSA-2026:0233 Released 2026-01-07 · Red Hat rating Important
    mariadb:10.5 security update
    • Red Hat Enterprise Linux AppStream (v. 8) Judy-1.0.5-18.module+el8.10.0+22630+cacda3f1.aarch64::mariadb:10.5, Judy-1.0.5-18.module+el8.10.0+22630+cacda3f1.ppc64le::mariadb:10.5, Judy-1.0.5-18.module+el8.10.0+22630+cacda3f1.s390x::mariadb:10.5 +47
  • RHSA-2026:0232 Released 2026-01-07 · Red Hat rating Important
    mariadb:10.11 security update
    • Red Hat Enterprise Linux AppStream (v. 8) Judy-1.0.5-18.module+el8.10.0+21221+7bee72c1.aarch64::mariadb:10.11, Judy-1.0.5-18.module+el8.10.0+21221+7bee72c1.ppc64le::mariadb:10.11, Judy-1.0.5-18.module+el8.10.0+21221+7bee72c1.s390x::mariadb:10.11 +47
  • RHSA-2026:0225 Released 2026-01-07 · Red Hat rating Important
    mariadb:10.3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) Judy-1.0.5-18.module+el8.9.0+19449+ad5852d3.aarch64::mariadb:10.3, Judy-1.0.5-18.module+el8.9.0+19449+ad5852d3.ppc64le::mariadb:10.3, Judy-1.0.5-18.module+el8.9.0+19449+ad5852d3.s390x::mariadb:10.3 +47
  • RHSA-2026:0137 Released 2026-01-06 · Red Hat rating Important
    mariadb security update
    • Red Hat Enterprise Linux AppStream (v. 9) mariadb-3:10.5.29-3.el9_7, mariadb-backup-3:10.5.29-3.el9_7, mariadb-common-3:10.5.29-3.el9_7 +8
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) mariadb-devel-3:10.5.29-3.el9_7, mariadb-embedded-devel-3:10.5.29-3.el9_7, mariadb-test-3:10.5.29-3.el9_7
  • RHSA-2026:0136 Released 2026-01-06 · Red Hat rating Important
    mariadb10.11 security update
    • Red Hat Enterprise Linux AppStream (v. 10) mariadb-3:10.11.15-1.el10_1, mariadb-backup-3:10.11.15-1.el10_1, mariadb-client-utils-3:10.11.15-1.el10_1 +13
  • RHSA-2026:0111 Released 2026-01-06 · Red Hat rating Important
    mariadb security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) mariadb-devel-3:10.5.29-3.el9_6, mariadb-embedded-devel-3:10.5.29-3.el9_6, mariadb-test-3:10.5.29-3.el9_6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) mariadb-3:10.5.29-3.el9_6, mariadb-backup-3:10.5.29-3.el9_6, mariadb-common-3:10.5.29-3.el9_6 +8
  • RHSA-2026:0112 Released 2026-01-06 · Red Hat rating Important
    mariadb security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) mariadb-3:10.5.22-2.el9_2, mariadb-backup-3:10.5.22-2.el9_2, mariadb-common-3:10.5.22-2.el9_2 +8
  • RHSA-2026:0061 Released 2026-01-05 · Red Hat rating Important
    mariadb security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) mariadb-devel-3:10.5.22-2.el9_4, mariadb-embedded-devel-3:10.5.22-2.el9_4, mariadb-test-3:10.5.22-2.el9_4
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) mariadb-3:10.5.22-2.el9_4, mariadb-backup-3:10.5.22-2.el9_4, mariadb-common-3:10.5.22-2.el9_4 +8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:0061
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:0111
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:0136
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:0225, RHSA-2026:0232, RHSA-2026:0233
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:0137, RHSA-2026:0247
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2026:0357
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:0333, RHSA-2026:0336
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:0304, RHSA-2026:0344
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:0304, RHSA-2026:0344
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:0295, RHSA-2026:0296
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:0351
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:0112
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:0376
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:0061, RHSA-2026:0335
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:0111, RHSA-2026:0334
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:0333, RHSA-2026:0336
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:0304, RHSA-2026:0344
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:0295, RHSA-2026:0296
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:0698
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:0137
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:0367
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:0367
Red Hat Hardened ImagesFixed RHSA-2026:8812, RHSA-2026:8813
Not affected: 2 products
  • Red Hat Enterprise Linux 10
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-13699
  2. 2026-10-03 Alias added: GHSA-rqf2-8625-4vgv

References

Advisory 1

Other 1

  • TI-2023-11776 MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via… CVSS 3.1CRITICAL 9.8
  • TI-2016-05707 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… CVSS 3.0CRITICAL 9.8
  • TI-2022-00687 Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVSS 3.1HIGH 7.5
  • TI-2014-00217 OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly… CVSS 3.1HIGH 7.4
  • TI-2014-00188 The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0… CVSS 2.0MEDIUM 6.8
  • TI-2018-15259 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if… CVSS 3.1HIGH 7.5
See all 459 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences