PT-2026-45149 · Mariadb Foundation+1 · Mariadb+1

CVE-2026-44171 · Published 2026-05-26 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MariaDB server versions 10.6.1 through 10.6.25 MariaDB server versions 10.11.1 through 10.11.16 MariaDB server versions 11.4.1 through 11.4.10 MariaDB server versions 11.8.1 through 11.8.6 MariaDB server version 12.3.1

Description The mbstream utility fails to validate the presence of /../ sequences in paths during the archive unpacking process. A specially crafted archive can exploit this lack of validation to create files outside of the intended target directory, a behavior known as path traversal.

Recommendations Update versions 10.6.1 through 10.6.25 to 10.6.26. Update versions 10.11.1 through 10.11.16 to 10.11.17. Update versions 11.4.1 through 11.4.10 to 11.4.11. Update versions 11.8.1 through 11.8.6 to 11.8.7. Update version 12.3.1 to 12.3.2.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BIT-MARIADB-2026-44171

BIT-MARIADB-MIN-2026-44171

BIT-MYSQL-CLIENT-2026-44171

CVE-2026-44171

ECHO-2251-F2E7-9C06

GHSA-9PJH-5HHW-65V9

OPENSUSE-SU-2026:10897-1

OPENSUSE-SU-2026:20933-1

RHSA-2026:25143

RHSA-2026:25145

RHSA-2026:33412

RHSA-2026:33464

RHSA-2026:33481

RHSA-2026:33482

SUSE-SU-2026:22095-1

SUSE-SU-2026:2282-1

SUSE-SU-2026:2284-1

SUSE-SU-2026:2330-1

USN-8536-1

Affected Products

Mariadb

Rocky Linux

References · 62

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44171.json · Exploit
• https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44168 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-48163 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8536-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20933-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2330-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:33482 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44169 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-49261 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-44171 · Security Note
• https://ubuntu.com/security/CVE-2026-44172 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44171 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44171 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44171 · Security Note