CVE-2026-85985: MariaDB: Unauthorized file access via CONNECT engine UDFs
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile(), bsonfile(), jfilemake(), bfilemake(), and jbinfile() are affected because each does not enforce FILE privilege or the securefilepriv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 10.6.28 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 10.11.19 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 11.4.13 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 11.8.9 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 12.3.3 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 13.0.2
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privileged database attacker who can call the affected CONNECT engine file-access UDFs can trigger it. Actual file access remains constrained by the operating-system permissions of the MariaDB server process.
Does secure_file_priv prevent exploitation?
No. The affected UDFs do not enforce the secure_file_priv setting, so relying on that setting does not block their file access.
What can an attacker do after triggering the flaw?
They can supply filesystem paths to the affected UDFs and read or write files that the database account would not otherwise be authorized to access, subject to operating-system permissions.
Which versions contain the fix?
The issue is fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.