CVE-2026-85985 in MariaDB
Summary
by MITRE • 10/16/2026
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The MariaDB server, a widely adopted community-developed fork of the MySQL database management system, contains a critical security flaw within its CONNECT engine plugin that affects multiple versions including those from the 10.6.x through 13.0.x release lines. Specifically, versions ranging from 10.6.1 up to but not including 10.6.28, as well as specific releases in the 10.11, 11.4, 11.8, 12.3, and 13.0 branches are vulnerable. The core of this vulnerability lies in the improper implementation of file-access user-defined functions within the CONNECT engine plugin. These functions include json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file(). In a properly secured database environment, access to external resources such as the underlying operating system filesystem must be strictly controlled through privilege checks and configuration settings designed to prevent unauthorized data exfiltration or modification.
The technical flaw stems from these specific user-defined functions failing to enforce the FILE privilege requirement or respect the secure_file_priv server variable setting. The secure_file_priv directive is a fundamental security control in MariaDB and MySQL that restricts where LOAD DATA, SELECT ... INTO OUTFILE, and LOAD_FILE() operations can read from and write to on the filesystem. By bypassing this check, as well as not verifying if the database user possesses the necessary FILE privilege, these functions allow any authenticated user with access to execute them to interact directly with the server's file system. This represents a significant deviation from the principle of least privilege, allowing operations that should be restricted to administrative accounts or explicitly authorized users to be performed by low-privileged accounts.
From an operational impact perspective, this vulnerability enables a low-privileged attacker who has authenticated access to the database to read sensitive files stored on the server's filesystem or write malicious content to existing locations. The scope of accessible files is limited only by the operating system permissions granted to the user account under which the MariaDB server process runs. This can lead to severe consequences such as the disclosure of configuration files containing plaintext credentials, private keys, or other sensitive data residing in directories like /etc or application-specific config folders. Furthermore, an attacker could potentially overwrite critical system or application files if they have write permissions in those locations, leading to service disruption or further compromise through techniques such as library injection or script execution depending on the file type and location targeted.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting a failure to enforce proper authorization checks before allowing access to sensitive resources. It also maps closely to MITRE ATT&CK technique T1005 Data from Local System, where an adversary seeks to collect data stored on local systems for later exfiltration or immediate use in further attacks. The ability to read arbitrary files facilitates reconnaissance and credential harvesting, while the write capability opens avenues for persistence mechanisms or denial of service conditions by corrupting essential system files.
To mitigate this risk, organizations running affected versions must immediately upgrade their MariaDB installations to patched releases such as 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 and later. In environments where upgrading is not immediately feasible, administrators should consider disabling the CONNECT engine plugin if it is not actively required for business operations, thereby removing the attack surface entirely. Additionally, ensuring that secure_file_priv is strictly configured to a specific directory containing only necessary data files can provide an additional layer of defense by limiting the paths accessible even if privilege checks are bypassed. Regular auditing of database user privileges and minimizing the operating system permissions assigned to the database service account further reduce the potential impact should such vulnerabilities be exploited in the future.