CVE-2026-44171: 
MariaDB Server vulnerability analysis and mitigation

CVE-2026-44171 is a path traversal vulnerability in MariaDB's mbstream backup utility that allows a specially crafted archive to write files outside the intended target directory during extraction. The flaw affects MariaDB versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and version 12.3.1. It was published on June 12, 2026, with the security advisory first disclosed on May 18, 2026 by researcher Riley Scott Jacob. The CVSS v3.1 base score is 6.3 (Medium) per the GitHub advisory, though NVD scores it at 7.8 (High) (GitHub Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal): mbstream fails to validate or sanitize /../ sequences in file paths embedded within backup archives before extracting them (GitHub Advisory). A legitimate MariaDB backup archive should never contain such path sequences, but an attacker who can supply a maliciously crafted archive to mbstream can cause it to write files to arbitrary filesystem locations outside the --target-dir path. Exploitation requires local access, high privileges, and user interaction (i.e., an administrator must be induced to extract the malicious archive), making the attack vector local with high complexity (GitHub Advisory). The issue is tracked upstream as MDEV-39408.

Successful exploitation allows an attacker to write arbitrary files to any location on the filesystem accessible by the user running mbstream, potentially overwriting sensitive system files, configuration files, or planting malicious executables to achieve code execution (GitHub Advisory). The confidentiality, integrity, and availability impacts are all rated High, as arbitrary file writes can lead to full system compromise. The attack is constrained to local access with high privilege requirements, limiting the immediate blast radius, but a successful exploit could enable privilege escalation or persistent backdoor installation.

1. Craft a malicious archive: Create a specially crafted mbstream-compatible backup archive containing file entries with path traversal sequences (e.g., ../../../../etc/cron.d/malicious) embedded in the file path metadata.
2. Deliver the archive: Social-engineer or otherwise supply the malicious archive to a privileged MariaDB administrator who will use mbstream to restore or extract it (e.g., by posing it as a legitimate backup).
3. Trigger extraction: The administrator runs mbstream -x --directory=/target-dir < malicious.xbstream, causing mbstream to process the archive without validating /../ sequences in paths.
4. Achieve arbitrary file write: mbstream writes files to attacker-controlled paths outside /target-dir (e.g., dropping a cron job, SSH authorized key, or web shell), potentially leading to code execution or privilege escalation (GitHub Advisory).

• File System: Unexpected files created outside the mbstream target directory immediately following a backup restore operation; new or modified files in sensitive directories (e.g., /etc/cron.d/, /root/.ssh/, web root directories) with timestamps matching a restore event.
• Logs: System logs (e.g., /var/log/auth.log, /var/log/syslog) showing new cron job execution or SSH logins shortly after an mbstream extraction; audit logs recording file creation events in unexpected paths by the MariaDB or backup service account.
• Process: mbstream process spawning unexpected child processes or writing to paths outside the designated backup target directory as observed via auditd or inotifywait monitoring.

Upgrade MariaDB to a patched version: 10.6.26 (for 10.6.x), 10.11.17 (for 10.11.x), 11.4.11 (for 11.4.x), 11.8.7 (for 11.8.x), or 12.3.2 (for 12.3.x) (GitHub Advisory). As a workaround prior to patching, restrict access to mbstream and backup restoration operations to trusted administrators only, and validate the integrity and provenance of backup archives before extraction (e.g., verify cryptographic signatures or checksums). Avoid extracting backup archives from untrusted or unverified sources.

SUSE issued security updates (SUSE-SU-2026:2282-1 and SUSE-SU-2026:2330-1) addressing this vulnerability in their MariaDB packages, and openSUSE followed with corresponding advisories (SUSE Advisory). Tenable published Nessus detection plugins (IDs 319624 and 321069) to identify vulnerable MariaDB installations. The vulnerability received routine coverage from security aggregators and Linux security news outlets, with no notable controversy or significant community debate observed.