Live › vulnerability › CVE-2026-85985
Go to dashboardSeveral CONNECT engine plugin functions in MariaDB (json_file, bson_file, jfile_make, bfile_make, jbin_file) do not enforce the FILE privilege or the secure_file_priv setting. A low-privileged database user can use them to read or write files the database account should not reach, limited by operating-system permissions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Servers running MariaDB 10.6.1 or later on the affected branches with the CONNECT storage engine plugin installed, where a database user other than a fully trusted administrator can run SQL. The flaw depends on the database account being able to call the CONNECT file functions. Servers on versions below each listed range or on the fixed releases are not affected, and so are servers without the CONNECT plugin.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mariadb | vendor | >= 10.6.1, < 10.6.28 | 10.6.28 |
| mariadb | vendor | >= 10.11.1, < 10.11.19 | 10.11.19 |
| mariadb | vendor | >= 11.4.1, < 11.4.13 | 11.4.13 |
| mariadb | vendor | >= 11.8.1, < 11.8.9 | 11.8.9 |
| mariadb | vendor | >= 12.3.1, < 12.3.3 | 12.3.3 |
| mariadb | vendor | = 13.0.1 | – |
SELECT VERSION(); in MariaDB and compare against the fixed versions belowSHOW PLUGINS; or SELECT * FROM information_schema.plugins WHERE plugin_name LIKE 'CONNECT'; to see whether the CONNECT plugin is installedsecure_file_priv is set: SHOW VARIABLES LIKE 'secure_file_priv';10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 on the matching release branchEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-85985")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.