MariaDB Server EUVD-2026-36516

Per the CVSS vector AV:L/AC:L/PR:N/UI:R, the attacker must deliver crafted input that is processed locally on the MariaDB Server host, and a local user must perform an action (UI:R) - for example loading a supplied file, importing a dump, or running a script that passes attacker-controlled path data to the vulnerable MariaDB code path. The target must be running MariaDB Server in one of the unpatched ranges (10.6.1-10.6.25, 10.11.1-10.11.16, 11.4.1-11.4.10, 11.8.1-11.8.6, or 12.3.1). Exploitation is limited by the local attack vector (no network reachability suffices), the required user interaction, and the fact that the vulnerable feature must actually be invoked against attacker-influenced input; note the published vector lists PR:N, which is atypical for a database server bug and should be confirmed against the GHSA-9pjh-5hhw-65v9 advisory before assuming truly unauthenticated triggering.

Severity signals are mixed: the CVSS 3.1 base score of 7.8 is driven by high C/I/A impact (AV:L/AC:L/PR:N/UI:R), but EPSS sits at 0.01% (2nd percentile), the CVE is not on CISA KEV, and no public PoC was identified, so real-world exploitation pressure is currently low. The CVSS vector itself is internally unusual - PR:N combined with AV:L and UI:R implies an unauthenticated attacker who nonetheless needs a local user to act on attacker-supplied input, which is more consistent with a malicious-file or malicious-input-processing scenario than with a remote network attack. Note an apparent inconsistency to verify with the vendor advisory: a database server bug normally implies an authenticated SQL session (PR:L) rather than PR:N, so the published vector may overstate ease of access. Net: treat this as a routine patch-cycle priority for MariaDB operators, not an emergency, but do not deprioritize it given full C/I/A impact once preconditions are met.

An attacker supplies crafted input containing directory-traversal sequences (for example via a filename argument processed by the server during an import, log, or file-handling operation) and induces a local user or DBA to execute the action that consumes it. The vulnerable path-handling code then reads from or writes to a location outside the intended directory, yielding disclosure, tampering, or denial of service. No public exploit is identified at time of analysis, and successful exploitation hinges on the required user-interaction step actually occurring.