Skip to main content

MariaDB Server EUVDEUVD-2026-36519

| CVE-2026-48163 HIGH
OS Command Injection (CWE-78)
N/A vendor:alpine
Command Injection MariaDB
7.2
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.2 HIGH
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.2 HIGH

Reachable over the network on the DB port (AV:N/AC:L) but requires an administrative DB account (PR:H); OS command execution as mysqld yields full C/I/A within that host's security scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

9
Analysis Updated
Jun 16, 2026 - 19:13 vuln.today
v5 (cvss_changed)
Analysis Updated
Jun 16, 2026 - 19:13 vuln.today
v4 (cvss_changed)
CVSS changed
Jun 16, 2026 - 19:07 NVD
8.0 (HIGH) 7.2 (HIGH)
Patch available
Jun 12, 2026 - 19:01 EUVD
Analysis Updated
Jun 12, 2026 - 18:30 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 12, 2026 - 18:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 12, 2026 - 18:22 vuln.today
cvss_changed
CVSS changed
Jun 12, 2026 - 18:22 NVD
8.0 (HIGH)
Analysis Generated
May 30, 2026 - 12:12 vuln.today

DescriptionNVD

Alpine Linux: mariadb fixed in 11.8.8-r0

AnalysisAI

OS command injection in MariaDB Server (CWE-78) affects multiple supported branches (10.6.x, 10.11.x, 11.4.x, 11.8.x, 12.3.x) and allows an attacker with high database privileges to execute arbitrary operating system commands on the database host, leading to full confidentiality, integrity, and availability compromise. The flaw is tracked by Alpine, the upstream MariaDB GHSA-rpgv-q6gv-684r advisory, and MDEV-39648, with patches already released across branches. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain high-privilege DB credentials
Delivery
Connect to mysqld over TCP/3306
Exploit
Issue admin operation with shell metacharacters
Execution
Server builds OS command from tainted input
Persist
Shell executes as mysqld OS user
Impact
Read data files and pivot on host
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated MariaDB session with high database privileges (CVSS PR:H - typically SUPER, FILE, or equivalent administrative grants), network reachability to the mysqld TCP port (default 3306) from the attacker, and a vulnerable server version in the 10.6.1-10.6.26, 10.11.1-10.11.17, 11.4.1-11.4.11, 11.8.1-11.8.7, or 12.3.1 ranges. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals are consistent but mixed in urgency: CVSS 3.1 base 7.2 with AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H confirms the vulnerability is reachable over the network but only by an account that already holds high privileges on the server, which is a major real-world brake. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained credentials for a highly privileged MariaDB account - for example via credential reuse, a leaked .my.cnf, or insider abuse in a managed/multi-tenant DB platform - connects to the server over the network on port 3306 and issues the vulnerable administrative operation with crafted parameters that smuggle shell metacharacters into the OS command the server builds internally. The injected command executes as the mysqld OS user, giving the attacker a foothold on the database host from which they can read on-disk data files, plant persistence, or pivot. …
Remediation Vendor-released patches are available: upgrade MariaDB Server to 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2 (or later) on the branch you run, per GHSA-rpgv-q6gv-684r and MDEV-39648. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all MariaDB Server instances in your environment, specifically identifying deployments running versions 10.6.x, 10.11.x, 11.4.x, 11.8.x, or 12.3.x. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in MariaDB

View all
CVE-2016-6662 CRITICAL POC
9.8 Sep 20

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
CVE-2012-5613 MEDIUM POC
6.0 Dec 03

MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the
CVE-2014-0195 MEDIUM POC
6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2012-2122 MEDIUM POC
5.1 Jun 26

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor
CVE-2012-5612 MEDIUM POC
6.5 Dec 03

Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly ot
CVE-2012-5611 MEDIUM POC
6.5 Dec 03

Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53
CVE-2014-3470 MEDIUM
4.3 Jun 05

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
CVE-2016-6664 HIGH POC
7.0 Dec 13

mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server befo
CVE-2014-0221 MEDIUM
4.3 Jun 05

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.
CVE-2015-3152 MEDIUM POC
5.9 May 16

Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the
CVE-2022-0778 HIGH POC
7.5 Mar 15

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9
CVE-2025-64328 HIGH POC
8.6

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8

Share

EUVD-2026-36519 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy