MariaDB
CVE-2025-13699
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to dump attacker-controlled DB
-
DeliveryCraft malicious view name with traversal
-
ExploitVictim runs mariadb-dump utility
-
ExecutionUnvalidated path used in file write
-
ImpactExecute code as current user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to run the mariadb-dump client utility against a database whose view names are attacker-controlled - e.g., a malicious or compromised MariaDB server the victim connects to and dumps, or an untrusted database/backup restored locally. The crafted view name must contain path-traversal sequences (CWE-22) that, because the user-supplied path is not validated before use in file operations, cause writes outside the intended directory and lead to code execution. Limiting factors that reduce real-world risk: mandatory user interaction (UI:R - the admin must actively invoke mariadb-dump against attacker-influenced data), high attack complexity (AC:H), a local attack vector (AV:L), and resulting code execution only at the privilege level of the user running the dump (no privilege escalation, S:U). |
| Impact | Signals point to a moderate, not urgent, priority. The CVSS 3.0 base score of 7.0 (HIGH) is driven by full C:H/I:H/A:H impact (code execution), but the exploitability metrics heavily constrain real-world risk: AV:L (local), AC:H (high complexity), and UI:R (requires a victim to run the utility). EPSS is low at 0.52% (43rd percentile), consistent with the lack of public exploit code and the absence of a CISA KEV listing - there is no public exploit identified at time of analysis and no evidence of active exploitation. These signals are internally consistent (low EPSS, no KEV, no POC, high complexity all agree this is not mass-exploitable). One notable conflict must be stated explicitly: the description repeatedly says 'remote attackers,' yet the CVSS vector is AV:L (local attack vector) - this reflects that the payload originates from an attacker-controlled/remote database but is triggered only when a local user runs mariadb-dump; defenders should treat it as a local/user-interaction bug, not a remotely reachable network service flaw, and verify intent with the vendor. Net: a legitimate HIGH-impact vulnerability worth patching in normal cycles, but it depends on social-engineering-style user interaction and does not warrant emergency response absent new exploitation signals. |
| Exploit ScenarioDerived | An attacker stands up a malicious MariaDB server or seeds a database (or a dump/backup) with a view whose name embeds path-traversal sequences. When a victim administrator runs the mariadb-dump client utility against that attacker-influenced database, the unvalidated view name is used in file operations, writing content outside the intended location and achieving code execution in the context of the user running the dump. No public proof-of-concept is currently identified, and the high attack complexity (AC:H) plus required user interaction (UI:R) make opportunistic exploitation unlikely. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Directory traversal in the mariadb-dump utility (part of MariaDB) allows code execution when the tool is run against a database with attacker-controlled view names. Exploitation requires the victim to invoke mariadb-dump against malicious or untrusted database content - such as a compromised server being dumped or an untrusted backup being restored - and only yields code execution at the dumping user's privilege level. The flaw (CWE-22, ZDI-CAN-27000) is scored CVSS 7.0 with high attack complexity and mandatory user interaction; EPSS is low (0.52%) and there is no KEV listing, with no public exploit identified at time of analysis.
RemediationAI
Check the MariaDB advisory MDEV-37483 (https://jira.mariadb.org/browse/MDEV-37483) for the fixed mariadb-dump versions and upgrade the MariaDB client tooling accordingly; the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-25-1025/ provides vendor-coordinated details. Where upgrading is not immediately possible, treat database content as untrusted input to the dumper: avoid running mariadb-dump against servers or databases you do not control, do not restore or dump untrusted backup archives on production hosts, and run dumps inside a container or under a low-privilege account whose writable paths cannot reach executables or startup locations - noting this limits but does not eliminate the file-write impact. As a defense-in-depth measure, restrict the paths the account invoking mariadb-dump can write to (e.g., a dedicated output directory with no execute permission), accepting the operational trade-off of tighter backup workflows.
Affected ProductsAI
MariaDB server installations shipping the affected mariadb-dump utility, per the vendor advisory MDEV-37483 (https://jira.mariadb.org/browse/MDEV-37483). The utility ships as part of the MariaDB client tooling, so systems using mariadb-dump for logical backups or migrations are the exposure point; the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-25-1025/) documents the reporting details. No CPE strings were supplied in the source data, so exact version cutoffs should be confirmed against the MariaDB JIRA advisory before concluding a given release is or is not affected.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in MariaDB's mariadb-dump client utility, the logical-backup counterpart to mysqldump, which reads schema metadata - including view names - from a server and writes the resulting SQL text to local files. View names are user-supplied metadata that mariadb-dump uses in file operations without validating for path-traversal sequences (CWE-22). Because a view's name can embed directory-traversal components, a crafted name can cause the utility to read or write outside the intended output directory, enabling an attacker who controls database metadata to plant files that subsequently execute in the context of the user running the dump. The CVSS:3.1 vector AV:L/AC:H/PR:N/UI:R reflects that the attacker cannot trigger this directly over the network: the victim must connect to and dump an attacker-influenced database, an inherently local, interaction-driven and complex chain. MariaDB's advisory is tracked as MDEV-37483 and the original report as ZDI-CAN-27000 / ZDI-25-1025.
Know when MariaDB gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:L and UI:R because a local user must run mariadb-dump; AC:H due to reliance on attacker-controlled DB and crafted view names; PR:N as no auth on the client; C/I/A:H from code execution as the invoking user.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000.
Executive ViewAI
MariaDB's mariadb-dump backup utility contains a directory traversal flaw that could let attacker-controlled database content achieve code execution on the machine performing a dump. The exposure is limited to staff and systems that dump or restore untrusted database content, but those are often privileged backup and DBA workstations with broad access to production data. Leadership should care because a single careless restore or dump of an untrusted source could compromise backup infrastructure credentials and integrity, though no exploitation has been observed and no patch is available.
No vendor patch identified at time of analysis; mitigate by dumping and restoring only trusted database content, validating untrusted backups in an isolated sandbox first, running mariadb-dump with least privilege and never as root, and restricting execution of the utility to authorized backup hosts and personnel.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor
Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly ot
Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server befo
The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.
Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n
GitHub PoC
Exploit-DB