CVE-2026-107814: MariaDB: Insecure $HOME in MariaDB rpm packages
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bashprofile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MariaDB serverto a version that resolves this vulnerability.Fixed in 10.6.28 - Upgrade
Upgrade
MariaDB serverto a version that resolves this vulnerability.Fixed in 10.11.19 - Upgrade
Upgrade
MariaDB serverto a version that resolves this vulnerability.Fixed in 11.4.13 - Upgrade
Upgrade
MariaDB serverto a version that resolves this vulnerability.Fixed in 11.8.9 - Upgrade
Upgrade
MariaDB serverto a version that resolves this vulnerability.Fixed in 12.3.3 - Upgrade
Upgrade
MariaDB serverto a version that resolves this vulnerability.Fixed in 13.0.2
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use MariaDB RPM packages in the vulnerable version ranges. Debian packages are not affected because the mysql service account uses /nonexistent as its home directory.
What access does an attacker need to exploit this?
The attacker needs access as a database user with the FILE privilege. They can use that privilege to write startup files such as .bash_profile into the mysql account's home directory, which is the database data directory in affected RPM packages.
When does the malicious startup file execute?
Execution requires an administrator to open a login shell for the mysql service account. The startup dot-file can then be processed in that account's home directory.
Which versions contain the fix?
The issue is fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.