Live › vulnerability › CVE-2026-92262
Go to dashboardMariaDB server accepts table names with a legacy #mysql50# prefix that skips normal filesystem name encoding, so table names can point at unencoded files on disk. An attacker with the ability to create tables can read or corrupt data and may reach remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mariadb | vendor | >= 10.6.1, < 10.6.28 | 10.6.28 |
| mariadb | vendor | >= 10.11.1, < 10.11.19 | 10.11.19 |
| mariadb | vendor | >= 11.4.1, < 11.4.13 | 11.4.13 |
| mariadb | vendor | >= 11.8.1, < 11.8.9 | 11.8.9 |
| mariadb | vendor | >= 12.3.1, < 12.3.3 | 12.3.3 |
| mariadb | vendor | = 13.0.1 | – |
Run SELECT VERSION(); on the MariaDB server and compare against the fixed versions.
Upgrade MariaDB to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 (or the patched release on your branch).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-92262")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.