Skip to main content

MariaDB Server EUVDEUVD-2026-36516

| CVE-2026-44171 HIGH
Path Traversal (CWE-22)
N/A vendor:alpine
Path Traversal MariaDB
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
7.3 HIGH

Local attack vector and required user interaction match the description; assessed PR:L because triggering a MariaDB server path handler realistically requires an authenticated database session, not anonymous access.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

8
Analysis Updated
Jun 16, 2026 - 19:58 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 16, 2026 - 19:58 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 16, 2026 - 19:52 vuln.today
cvss_changed
Severity Changed
Jun 16, 2026 - 19:52 NVD
MEDIUM HIGH
CVSS changed
Jun 16, 2026 - 19:52 NVD
6.3 (MEDIUM) 7.8 (HIGH)
Patch available
Jun 12, 2026 - 19:01 EUVD
CVSS changed
Jun 12, 2026 - 18:22 NVD
6.3 (MEDIUM)
Analysis Generated
May 27, 2026 - 23:12 vuln.today

DescriptionNVD

Alpine Linux: mariadb fixed in 11.8.7-r0

AnalysisAI

Path traversal in MariaDB Server (CVE-2026-44171) allows a local attacker to escape intended directory boundaries via user-interaction-driven file handling, with full confidentiality, integrity, and availability impact (CVSS 7.8). Multiple stable branches are affected, with fixes shipped in 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2; Alpine Linux has packaged the fix as mariadb 11.8.7-r0. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Stage malicious path-traversal payload locally
Delivery
Induce local user to process input
Exploit
Trigger vulnerable path handler in mariadbd
Execution
Escape data directory boundary
Persist
Read or overwrite arbitrary files
Impact
Compromise database confidentiality, integrity, availability
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Per the CVSS vector AV:L/AC:L/PR:N/UI:R, the attacker must deliver crafted input that is processed locally on the MariaDB Server host, and a local user must perform an action (UI:R) - for example loading a supplied file, importing a dump, or running a script that passes attacker-controlled path data to the vulnerable MariaDB code path. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Severity signals are mixed: the CVSS 3.1 base score of 7.8 is driven by high C/I/A impact (AV:L/AC:L/PR:N/UI:R), but EPSS sits at 0.01% (2nd percentile), the CVE is not on CISA KEV, and no public PoC was identified, so real-world exploitation pressure is currently low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker supplies crafted input containing directory-traversal sequences (for example via a filename argument processed by the server during an import, log, or file-handling operation) and induces a local user or DBA to execute the action that consumes it. The vulnerable path-handling code then reads from or writes to a location outside the intended directory, yielding disclosure, tampering, or denial of service. …
Remediation Vendor-released patches are available - upgrade MariaDB Server to 10.6.26, 10.11.17, 11.4.11, 11.8.7, or 12.3.2 depending on which branch you run, per the EUVD record and the upstream advisory at https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9 and bug https://jira.mariadb.org/browse/MDEV-39408. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: identify and document all MariaDB Server instances in production and development environments, recording their current versions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in MariaDB

View all
CVE-2016-6662 CRITICAL POC
9.8 Sep 20

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
CVE-2012-5613 MEDIUM POC
6.0 Dec 03

MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the
CVE-2014-0195 MEDIUM POC
6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2012-2122 MEDIUM POC
5.1 Jun 26

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor
CVE-2012-5612 MEDIUM POC
6.5 Dec 03

Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly ot
CVE-2012-5611 MEDIUM POC
6.5 Dec 03

Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53
CVE-2014-3470 MEDIUM
4.3 Jun 05

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
CVE-2016-6664 HIGH POC
7.0 Dec 13

mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server befo
CVE-2014-0221 MEDIUM
4.3 Jun 05

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.
CVE-2015-3152 MEDIUM POC
5.9 May 16

Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the
CVE-2022-0778 HIGH POC
7.5 Mar 15

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Same technique Path Traversal

View all
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5
CVE-2022-27925 HIGH POC
7.2
CVE-2023-47246 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2024-41713 CRITICAL POC
9.1
CVE-2016-0752 HIGH POC
7.5

Share

EUVD-2026-36516 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy