PT-2026-45151 · Mariadb Foundation+1 · Mariadb+1

CVE-2026-44173 · Published 2026-05-26 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions MariaDB versions 10.6.1 through 10.6.25 MariaDB versions 10.11.1 through 10.11.16 MariaDB versions 11.4.1 through 11.4.10 MariaDB versions 11.8.1 through 11.8.6 MariaDB version 12.3.1

Description MariaDB allows the execution of 'SELECT ... INTO OUTFILE' and 'SELECT ... INTO DUMPFILE' without verifying the FILE privilege when the FROM clause contains only subqueries.

Recommendations Update versions 10.6.1 through 10.6.25 to 10.6.26. Update versions 10.11.1 through 10.11.16 to 10.11.17. Update versions 11.4.1 through 11.4.10 to 11.4.11. Update versions 11.8.1 through 11.8.6 to 11.8.7. Update version 12.3.1 to 12.3.2.

Exploit

Fix

Incorrect Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-863

CWE-266

Related Identifiers

BIT-MARIADB-2026-44173

BIT-MARIADB-MIN-2026-44173

BIT-MYSQL-CLIENT-2026-44173

CVE-2026-44173

ECHO-DF27-3587-1DC5

GHSA-667J-M53J-WPMC

OPENSUSE-SU-2026:10897-1

OPENSUSE-SU-2026:20933-1

RHSA-2026:25143

RHSA-2026:25145

RHSA-2026:33412

RHSA-2026:33464

RHSA-2026:33481

RHSA-2026:33482

SUSE-SU-2026:22095-1

SUSE-SU-2026:2282-1

SUSE-SU-2026:2284-1

SUSE-SU-2026:2330-1

USN-8536-1

Affected Products

Mariadb

Rocky Linux

References · 73

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44173.json · Exploit
• https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44168 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-48163 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mariadb-min-2026-44173 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44173 · Security Note
• https://osv.dev/vulnerability/USN-8536-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:33482 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20933-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2330-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:25145 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:33482 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:33093 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44169 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-49261 · Vendor Advisory