---
id: "CVE-2026-102523"
kind: "vulnerability"
aliases: ["CVE-2026-102523"]
title: "MariaDB: partition conversion lets a database user reach other tables"
severity: "high"
cvss: 8.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database", "mariadb", "package", "self-hosted"]
not_affected_if: ["no-untrusted-db-users", "unaffected-version"]
published_at: "2026-11-05T16:17:23+00:00"
first_seen_at: "2026-11-05T16:40:01+00:00"
updated_at: "2026-11-05T16:41:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102523", "first_seen_at": "2026-11-05T16:40:01+00:00"}]
exploit_sources: []
---

# MariaDB: partition conversion lets a database user reach other tables

MariaDB's ALTER TABLE ... CONVERT ... PARTITION does not escape user-specified partition names before using them in file paths. An authenticated database user can make the conversion act on table files they are not authorized to read or modify.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- MariaDB 10.11.x: `10.11.19`
- MariaDB 11.4.x: `11.4.13`
- MariaDB 11.8.x: `11.8.9`
- MariaDB 12.3.x: `12.3.3`
- MariaDB 13.0.x: `13.0.2`

## Timeline

- 2026-11-05T16:40:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102523

## Documents

- [advisory] Vendor advisory: github.com https://github.com/MariaDB/server/security/advisories/GHSA-h4vr-wpff-jfx4
- [fix] Release notes: github.com https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19
- [fix] Release notes: github.com https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13
- [fix] Patch: github.com https://github.com/MariaDB/server/commit/98437c30ae52ed709f266e5f8095d779261a5879
- [fix] Release notes: github.com https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3
- [fix] Release notes: github.com https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2
- [fix] Release notes: github.com https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9

## From the sources

MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_