MariaDB Server EUVD-2026-95919

Requires (1) a MariaDB account holding the FILE privilege; (2) secure-file-priv configured to permit writes into /run/mysqld (not the default restricted import/export directory), enabling creation of /run/mysqld/wsrep-new-cluster; (3) an installation using the packaged mariadb.service systemd unit (Debian/RPM layouts where that directory is writable by the mysql user); and (4) a subsequent restart of mariadb.service, since the injected EnvironmentFile is only consumed on the next start. Limiting factors that reduce realistic risk: the FILE privilege is a high, non-default grant; the vulnerable secure-file-priv target path is non-default; and exploitation is gated on an administrator-triggered service restart rather than being immediately attacker-controlled.

The vendor CVSS of 8.4 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) is driven largely by the scope change (S:C) - a database user escalating into the host/systemd context - combined with full C/I/A impact. However, the AV:N rating is somewhat misleading: although the FILE privilege is exercised over a network SQL connection, actual exploitation depends on writing to a local path (/run/mysqld) that is only reachable when secure-file-priv is configured to permit it, which is NOT the default. The vector already honestly reflects the main gates with PR:H (requires a FILE-privileged account) and UI:R (the injected environment only takes effect on the NEXT service restart, i.e. an administrator action). No EPSS score, CISA KEV entry, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: this is a genuine local-to-root style privilege-escalation primitive rather than a mass-exploitable remote RCE - a meaningful priority for multi-tenant or Galera/wsrep MariaDB deployments where untrusted users hold FILE privilege, but materially lower real-world risk than the 8.4 implies for single-admin installations with default secure-file-priv. Conflicting signal to verify: CVSS says AV:N while the description requires local filesystem write via a non-default configuration - treat the network-exploitability as conditional.

In a shared or Galera-clustered MariaDB deployment, a database account holding the FILE privilege, on a host where secure-file-priv permits writing into /run/mysqld, uses SQL (e.g. SELECT ... INTO OUTFILE) to create /run/mysqld/wsrep-new-cluster containing attacker-controlled _WSREP_NEW_CLUSTER/environment content. When the mariadb.service unit is next restarted, systemd reads that file as an EnvironmentFile and injects the attacker-controlled values into the service, letting the attacker influence the mariadbd command line and escalate beyond their database authorization. No public exploit code is identified at time of analysis.