MariaDB Server EUVD-2026-117548

Requires an authenticated MariaDB account with privilege to run ALTER TABLE on a partitioned table, and the partition plugin must be enabled (the default). The concrete trigger is a user-specified partition name that requires filename escaping - demonstrated with names like foo-bar or a #mysql50#-prefixed name - passed to ALTER TABLE ... CONVERT ... PARTITION, where the name is used in filesystem path construction without filename encoding. Limiting factors: the attacker must already hold a database foothold with ALTER rights (PR:L), and the attack is confined to servers running affected versions (10.11.1-10.11.18, 11.4.1-11.4.12, 11.8.1-11.8.8, 12.3.1-12.3.2, 13.0.1) with partitioning active. The vendor-stated workaround is to disable partition support with --skip-plugin-partition; the complete fix is upgrading to 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2.

This is a credible, prioritizable issue but not an emergency. The input CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, 8.0) and the description agree that exploitation requires an authenticated low-privilege database user (PR:L), which bounds the threat to users who already have a database account and the ability to run ALTER TABLE on a partitioned table. The vuln.today decision label is 'this_week', consistent with a serious authorization bypass that is not under active attack. There is NO CISA KEV listing and NO EPSS score in the provided data, and no public exploit was supplied, so there is no public exploit identified at time of analysis - the only working trigger shown is the project's own regression test in the fix commit, which is not attacker exploit code. One inconsistency to verify: the input vector carries UI:R (user interaction required), but the described attack is performed directly by the authenticated attacker issuing the ALTER TABLE statement with no separate victim action, which argues for UI:N; this discrepancy slightly raises real exploitability versus the published vector. Net: a real authorization-bypass requiring an authenticated foothold, worth patching promptly, but lower urgency than an unauthenticated or actively-exploited flaw.

An authenticated database user who can run ALTER TABLE on a partitioned table creates or targets a partition whose name requires filename escaping (e.g. containing '-' or a '#mysql50#' prefix) and issues ALTER TABLE ... CONVERT ... PARTITION. Because the user-supplied partition name is not passed through filename encoding before filesystem path construction, the conversion operates on on-disk table files the user is not authorized to access, yielding unauthorized reads or modifications of other tables. No public exploit was provided; the fix commit includes a regression test demonstrating the trigger but that is not weaponized exploit code.