CVE-Katalog

CVE-2026-44171

Schweregrad: Medium · CVSS 6.3CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Published: May 19, 2026, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.19% · Oct 22, 2026

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	mariadb	sid	`1:11.8.9+ds-4`	fixed
Debian	mariadb	forky	`1:11.8.9+ds-2`	fixed
Debian	mariadb	trixie	`1:11.8.6-0+deb13u1`	vulnerable
Debian	mariadb	bookworm	`1:10.11.18-0+deb12u1`	fixed
Debian	mariadb	bookworm-security	`1:10.11.19-0+deb12u1`	fixed
Cpe	mariadb	Not reported	`10.6.26`	fixed
Cpe	mariadb	Not reported	`10.11.17`	fixed
Cpe	mariadb	Not reported	`11.4.11`	fixed
Cpe	mariadb	Not reported	`11.8.7`	fixed
Cpe	mariadb	Not reported	Not reported	unknown
Cpe	mariadb	Not reported	`1:10.11.18-0+deb12u1`	fixed
Alpine	mariadb	3.20	`10.11.17-r0`	fixed
Alpine	mariadb	3.21	`11.4.11-r0`	fixed
Alpine	mariadb	3.22	`11.4.11-r0`	fixed
Alpine	mariadb	3.23	`11.4.11-r0`	fixed
Alpine	mariadb	3.24	`11.8.7-r0`	fixed
Ubuntu	mariadb-10.0	16.04	`10.0.20-0ubuntu0.15.04.1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.22-0ubuntu1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.23-1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.23-2`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.24-7`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.25-0ubuntu0.16.04.1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.27-0ubuntu0.16.04.1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.28-0ubuntu0.16.04.1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.29-0ubuntu0.16.04.1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.31-0ubuntu0.16.04.2`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.33-0ubuntu0.16.04.1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.34-0ubuntu0.16.04.1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.36-0ubuntu0.16.04.1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.38-0ubuntu0.16.04.1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`10.1.25-1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.29-6`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.34-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.38-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.38-0ubuntu0.18.04.2`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.40-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.41-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.43-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.44-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.47-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.48-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.17-1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.18-1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.19-1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.21-2`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.22-1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.22-1ubuntu1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.25-0ubuntu0.20.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.29-0ubuntu0.20.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.30-0ubuntu0.20.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.31-0ubuntu0.20.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.32-0ubuntu0.20.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.34-0ubuntu0.20.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.37-0ubuntu0.20.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.38-0ubuntu0.20.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.39-0ubuntu0.20.04.2`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.7-2ubuntu1`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.7-2ubuntu1.1`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.11-0ubuntu0.22.04.1`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.12-0ubuntu0.22.04.1`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.16-0ubuntu0.22.04.1`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.18-0ubuntu0.22.04.1`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.21-0ubuntu0.22.04.2`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.22-0ubuntu0.22.04.1`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.23-0ubuntu0.22.04.1`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.4-1`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.5-3`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.6-1`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.6-2`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.7-2ubuntu1`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.7-2ubuntu2`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.8-0ubuntu0.24.04.1`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.11-0ubuntu0.24.04.2`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.13-0ubuntu0.24.04.1`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.14-0ubuntu0.24.04.1`	vulnerable
Ubuntu	mariadb	25.10	`1:11.4.5-1`	vulnerable
Ubuntu	mariadb	25.10	`1:11.8.1-4`	vulnerable
Ubuntu	mariadb	25.10	`1:11.8.1-5ubuntu2`	vulnerable
Ubuntu	mariadb	25.10	`1:11.8.2-1ubuntu1`	vulnerable
Ubuntu	mariadb	25.10	`1:11.8.3-1`	vulnerable
Ubuntu	mariadb	25.10	`1:11.8.3-1build1`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.3-1build1`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.5-1`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.5-2`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.5-3`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.5-4`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.6-1`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.6-3`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.6-4`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.6-5`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.6-5ubuntu0.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	mariadb	source	sid	`1:11.8.8-1`	not yet assigned	Not reported	Not reported
Debian	mariadb	source	forky	`1:11.8.8-1`	not yet assigned	Not reported	Not reported
Debian	mariadb	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	mariadb	source	bookworm	`1:10.11.18-0+deb12u1`	not yet assigned	Not reported	Not reported
Cpe	mariadb	cpe	Not reported	`10.6.26`	Not reported	Not reported	Not reported
Cpe	mariadb	cpe	Not reported	`10.11.17`	Not reported	Not reported	Not reported
Cpe	mariadb	cpe	Not reported	`11.4.11`	Not reported	Not reported	Not reported
Cpe	mariadb	cpe	Not reported	`11.8.7`	Not reported	Not reported	Not reported
Cpe	mariadb	cpe	Not reported	`1:10.11.18-0+deb12u1`	Not reported	Not reported	Not reported
Alpine	mariadb	apk	3.20	`10.11.17-r0`	Not reported	ALPINE-CVE-2026-44171	Not reported
Alpine	mariadb	apk	3.21	`11.4.11-r0`	Not reported	ALPINE-CVE-2026-44171	Not reported
Alpine	mariadb	apk	3.22	`11.4.11-r0`	Not reported	ALPINE-CVE-2026-44171	Not reported
Alpine	mariadb	apk	3.23	`11.4.11-r0`	Not reported	ALPINE-CVE-2026-44171	Not reported
Alpine	mariadb	apk	3.24	`11.8.7-r0`	Not reported	ALPINE-CVE-2026-44171	Not reported
Ubuntu	mariadb	deb	26.04	`1:11.8.6-5ubuntu0.1`	Not reported	UBUNTU-CVE-2026-44171	Not reported

Notes

[trixie] mariadb: Will be fixed via point release

OpenFactory catalog packages

[Debian 13 (Trixie)]

[libmariadb3]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
[libmariadbd19t64]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
[libmariadbd-dev]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
[libmariadb-dev]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
[libmariadb-dev-compat]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
[mariadb-backup]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
[mariadb-client]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
[mariadb-client-compat]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · all · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · all · trixie
  Betroffen
  nvd · mariadb · debian · 13
[mariadb-client-core]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
[mariadb-common]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · all · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · all · trixie
  Betroffen
  nvd · mariadb · debian · 13
[mariadb-plugin-connect]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
[mariadb-plugin-connect-jdbc]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · all · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · all · trixie
  Betroffen
  nvd · mariadb · debian · 13
[mariadb-plugin-cracklib-password-check]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
[mariadb-plugin-gssapi-client]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
[mariadb-plugin-gssapi-server]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
[mariadb-plugin-hashicorp-key-management]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
[mariadb-plugin-mroonga]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
[mariadb-plugin-oqgraph]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
[mariadb-plugin-provider-bzip2]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
[mariadb-plugin-provider-lz4]Betroffen
Quellpaket: [mariadb]
Details (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Betroffen
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Betroffen
  nvd · mariadb · debian · 13

Weitere Ergebnisse

Beobachtet: Oct 23, 2026, 10:02:54 PM UTC

Referenzen

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]