CVE-2026-44173: 
MariaDB Server vulnerability analysis and mitigation

CVE-2026-44173 is a FILE privilege bypass vulnerability in MariaDB Server that allows attackers to write arbitrary files to the server filesystem without the required FILE privilege. The flaw affects MariaDB versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and version 12.3.1. It was discovered by researcher Tomer Fichman, published as a GitHub Security Advisory (GHSA-667j-m53j-wpmc) on May 18, 2026, and assigned CVE-2026-44173 with a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is an incorrect authorization check (CWE-863) in MariaDB's query processing logic. When a SELECT ... INTO OUTFILE or SELECT ... INTO DUMPFILE statement is issued with a FROM clause containing only subqueries (rather than direct table references), the server fails to verify whether the executing user holds the FILE privilege. This means any authenticated database user — regardless of their privilege level — can trigger file write operations on the server filesystem by crafting a query such as SELECT * FROM (SELECT 'data') AS t INTO OUTFILE '/path/to/file'. The vulnerability is tracked upstream as MDEV-39493 (GitHub Advisory).

Successful exploitation allows an authenticated attacker to write arbitrary data to files accessible by the MariaDB server process on the host filesystem, bypassing the intended FILE privilege restriction. This could be leveraged to overwrite configuration files, plant web shells in web-accessible directories, or corrupt application data, leading to integrity compromise and potential escalation to remote code execution. Availability impact is rated low, and there is no direct confidentiality impact, but the ability to write files could facilitate further attacks depending on the server's environment (GitHub Advisory).

1. Reconnaissance: Identify MariaDB instances running vulnerable versions (10.6.1–10.6.25, 10.11.1–10.11.16, 11.4.1–11.4.10, 11.8.1–11.8.6, or 12.3.1) using network scanning tools such as Nmap with service version detection (nmap -sV -p 3306 <target>).
2. Obtain database credentials: Acquire any valid database user credentials — even a low-privileged account without the FILE privilege is sufficient to exploit this vulnerability.
3. Connect to the database: Establish a connection to the MariaDB instance using a client such as mysql -u <user> -p -h <target>.
4. Craft the malicious query: Execute a SELECT ... INTO OUTFILE statement where the FROM clause uses only a subquery, bypassing the FILE privilege check. Example: SELECT * FROM (SELECT '<?php system($_GET["cmd"]); ?>') AS t INTO OUTFILE '/var/www/html/shell.php';
5. Achieve objective: The file is written to the target path on the server filesystem. If written to a web-accessible directory, the attacker can subsequently access the web shell to execute arbitrary OS commands (GitHub Advisory).

• Logs: MariaDB general query log entries showing SELECT ... INTO OUTFILE or SELECT ... INTO DUMPFILE statements with subqueries in the FROM clause executed by users without the FILE privilege; unexpected file write errors or successes in MariaDB error logs.
• File System: Unexpected new files created in web-accessible directories or sensitive system paths (e.g., /var/www/, /etc/) owned by the mysql user; presence of web shells or configuration files with recent modification timestamps matching database activity.
• Network: Database connections from unusual source IPs or at unusual times, particularly followed by HTTP requests to newly created files on the web server.
• Process: Unexpected child processes spawned from the MariaDB process (e.g., shell interpreters) if a web shell was successfully deployed and executed.

Upgrade MariaDB to a patched version: 10.6.26 or later, 10.11.17 or later, 11.4.11 or later, 11.8.7 or later, or 12.3.2 or later, depending on the branch in use (GitHub Advisory). As a workaround prior to patching, configure the --secure-file-priv option to restrict the directories to which MariaDB can write files, and apply OS-level filesystem permissions to limit the MariaDB process user's write access. Additionally, enforce the principle of least privilege for all database accounts and restrict direct database access to trusted hosts via network access controls.

SUSE issued security updates for MariaDB packages addressing this vulnerability (SUSE-SU-2026:2282-1 and SUSE-SU-2026:2330-1), and openSUSE published corresponding advisories (SUSE Advisory). Tenable released Nessus detection plugins (IDs 319630 and 321069) to identify vulnerable MariaDB installations (Tenable). The vulnerability received routine coverage from security aggregators and Linux security news outlets, with no notable controversy or significant social media discussion observed.