CVE-2026-102523 · Package
NO FIX YET · SEE WHAT TO DO
MariaDB's ALTER TABLE ... CONVERT ... PARTITION does not escape user-specified partition names before using them in file paths. An authenticated database user can make the conversion act on table files they are not authorized to read or modify.
first public Sep 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Servers running an affected MariaDB release where users with database accounts can run ALTER TABLE ... CONVERT ... PARTITION. Exposure depends on which accounts exist and what they are allowed to do, so review who holds ALTER privileges. Deployments on unaffected versions can skip it.
Not affected if no-untrusted-db-users, unaffected-version
Who cares database, mariadb, self-hosted
Unknown from the sources.
10.11.1911.4.1311.8.912.3.313.0.2MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.