{"id":"CVE-2026-85985","kind":"vulnerability","aliases":["CVE-2026-85985"],"related":[],"title":"MariaDB CONNECT plugin: file UDFs skip FILE privilege and secure_file_priv checks","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","summary":"Several CONNECT engine plugin functions in MariaDB (json_file, bson_file, jfile_make, bfile_make, jbin_file) do not enforce the FILE privilege or the secure_file_priv setting. A low-privileged database user can use them to read or write files the database account should not reach, limited by operating-system permissions.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mariadb","fixed":["10.6.28"],"affected":">= 10.6.1, < 10.6.28","ecosystem":"vendor"},{"name":"mariadb","fixed":["10.11.19"],"affected":">= 10.11.1, < 10.11.19","ecosystem":"vendor"},{"name":"mariadb","fixed":["11.4.13"],"affected":">= 11.4.1, < 11.4.13","ecosystem":"vendor"},{"name":"mariadb","fixed":["11.8.9"],"affected":">= 11.8.1, < 11.8.9","ecosystem":"vendor"},{"name":"mariadb","fixed":["12.3.3"],"affected":">= 12.3.1, < 12.3.3","ecosystem":"vendor"},{"name":"mariadb","fixed":[],"affected":"= 13.0.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["database","mariadb","package","self-hosted"],"not_affected_if":["connect-plugin-not-installed","trusted-users-only"],"how_to_check":"- Run `SELECT VERSION();` in MariaDB and compare against the fixed versions below\n- Run `SHOW PLUGINS;` or `SELECT * FROM information_schema.plugins WHERE plugin_name LIKE 'CONNECT';` to see whether the CONNECT plugin is installed\n- Check whether `secure_file_priv` is set: `SHOW VARIABLES LIKE 'secure_file_priv';`","fix":"- Upgrade MariaDB to `10.6.28`, `10.11.19`, `11.4.13`, `11.8.9`, `12.3.3`, or `13.0.2` on the matching release branch\n- If upgrading is not possible, uninstall the CONNECT plugin or restrict database accounts so untrusted users cannot call its functions\n- The sources do not name a fixed version for the 13.0.1 line; the description says 13.0.2 fixes it","status":"open","published_at":"2026-10-16T17:17:51+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:18:30+00:00","updated_at":"2026-10-25T04:18:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:18:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MariaDB to `10.6.28`, `10.11.19`, `11.4.13`, `11.8.9`, `12.3.3`, or `13.0.2` on the matching release branch\n- If upgrading is not possible, uninstall the CONNECT plugin or restrict database accounts so untrusted users cannot call its functions\n- The sources do not name a fixed version for the 13.0.1 line; the description says 13.0.2 fixes it","reach":"network","title":"MariaDB CONNECT plugin: file UDFs skip FILE privilege and secure_file_priv checks","impact":"medium","summary":"Several CONNECT engine plugin functions in MariaDB (json_file, bson_file, jfile_make, bfile_make, jbin_file) do not enforce the FILE privilege or the secure_file_priv setting. A low-privileged database user can use them to read or write files the database account should not reach, limited by operating-system permissions.","category":"package","nicknames":[],"who_cares":["mariadb","self-hosted","database"],"confidence":0.7,"needs_auth":"yes","worst_case":"Database user reads or writes server files outside their grants","analyst_note":"Confirm whether the CONNECT plugin is installed by default in the packaged MariaDB builds and whether 13.0.1 has a fixed version, via the MariaDB advisory linked from the NVD entry.","how_to_check":"- Run `SELECT VERSION();` in MariaDB and compare against the fixed versions below\n- Run `SHOW PLUGINS;` or `SELECT * FROM information_schema.plugins WHERE plugin_name LIKE 'CONNECT';` to see whether the CONNECT plugin is installed\n- Check whether `secure_file_priv` is set: `SHOW VARIABLES LIKE 'secure_file_priv';`","needs_analyst":true,"not_affected_if":["connect-plugin-not-installed","trusted-users-only"],"who_is_affected":"Servers running MariaDB 10.6.1 or later on the affected branches with the CONNECT storage engine plugin installed, where a database user other than a fully trusted administrator can run SQL. The flaw depends on the database account being able to call the CONNECT file functions. Servers on versions below each listed range or on the fixed releases are not affected, and so are servers without the CONNECT plugin.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000794,"input_tokens":3700,"output_tokens":847,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-85985':16A,19A '10.11.19':101C,202C '10.6.1':98C '10.6.28':100C,201C '11.4.13':102C,203C '11.8.9':103C,204C '12.3.3':104C,205C '13.0.2':106C,207C 'access':113C,156C,168C,171C,188C 'account':77B,183C 'affect':127C 'attack':145C 'author':186C 'bfile':45B,121C 'bson':41B,117C 'call':151C 'check':13A 'communiti':91C 'connect':2A,33B,108C,153C,165C 'cve':14A,17A 'databas':26B,65B,76B,182C 'develop':92C 'enforc':51B,132C 'engin':34B,109C 'file':4A,7A,11A,40B,42B,48B,53B,58B,74B,112C,116C,118C,125C,133C,138C,155C,167C,179C 'file-access':111C,154C,166C 'filesystem':160C,173C 'fix':198C 'fork':93C 'function':36B 'host':31B 'invok':163C 'issu':149C,196C 'jbin':47B,124C 'jfile':43B,119C 'json':39B,115C 'limit':81B 'low':63B,143C 'low-privileg':62B,142C 'make':44B,46B,120C,122C 'mariadb':1A,20A,21A,22A,23A,24A,25A,27B,38B,87C 'mysql':95C 'oper':84B,192C 'operating-system':83B,191C 'packag':28B 'path':161C,174C 'permiss':86B,194C 'plugin':3A,35B,110C 'priv':12A,59B,139C 'privileg':8A,54B,64B,134C,144C 'reach':80B 'read':71B,176C 'secur':10A,57B,137C 'self':30B 'self-host':29B 'server':88C,96C 'set':60B,140C 'sever':32B 'skip':6A 'subject':189C 'system':85B,193C 'trigger':147C 'udf':5A,114C,157C,169C 'use':68B 'user':66B 'version':200C 'write':73B,178C","nicknames":[],"mitigations":[],"who_affected":"Servers running MariaDB 10.6.1 or later on the affected branches with the CONNECT storage engine plugin installed, where a database user other than a fully trusted administrator can run SQL. The flaw depends on the database account being able to call the CONNECT file functions. Servers on versions below each listed range or on the fixed releases are not affected, and so are servers without the CONNECT plugin.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T17:17:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85985","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85985","severity":null,"published_at":"2026-10-16T17:17:51+00:00","modified_at":"2026-10-20T15:32:46+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}