CVE-2026-44171

Name of the Vulnerable Software and Affected Versions MariaDB server versions 10.6.1 through 10.6.25 MariaDB server versions 10.11.1 through 10.11.16 MariaDB server versions 11.4.1 through 11.4.10 MariaDB server versions 11.8.1 through 11.8.6 MariaDB server version 12.3.1

Description The mbstream utility fails to validate the presence of /../ sequences in paths during the archive unpacking process. A specially crafted archive can exploit this lack of validation to create files outside of the intended target directory, a behavior known as path traversal.

Recommendations Update versions 10.6.1 through 10.6.25 to 10.6.26. Update versions 10.11.1 through 10.11.16 to 10.11.17. Update versions 11.4.1 through 11.4.10 to 11.4.11. Update versions 11.8.1 through 11.8.6 to 11.8.7. Update version 12.3.1 to 12.3.2.