CVE-2026-107814

Name of the Vulnerable Software and Affected Versions MariaDB versions 10.6.1 through 10.6.27 MariaDB version 10.11.18 and earlier MariaDB version 11.4.12 and earlier MariaDB version 11.8.8 and earlier MariaDB version 12.3.2 and earlier MariaDB version 13.0.1 and earlier

Description In RPM packages, the dedicated mysql service account is created with the database data directory as its home directory. A database user possessing the FILE privilege can write startup dot-files, such as .bash profile, into the $HOME directory. These files may then be executed when an administrator opens a login shell for the mysql account.

Recommendations Update to version 10.6.28 Update to version 10.11.19 Update to version 11.4.13 Update to version 11.8.9 Update to version 12.3.3 Update to version 13.0.2