CVE-2025-13699

EUVD-2025-204966

23.12.2025, 22:15

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000.

Path Traversal

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
zdi	CNA	7 HIGH	LOCAL	HIGH	NONE	CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 33%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
mariadb	mariadb	11.8.3	CNA

Debian Releases

Debian Product

Codename

mariadb

bookworm	no-dsa
forky	1:11.8.8-1 fixed
sid	1:11.8.8-1 fixed
trixie	1:11.8.6-0+deb13u1 fixed

mariadb-10.5

bullseye	postponed
bullseye (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

mariadb

jammy	dne
noble	needs-triage
plucky	ignored
questing	needs-triage
resolute	not-affected

mariadb-10.0

jammy	dne
noble	dne
questing	dne
resolute	dne
xenial	ignored

mariadb-10.1

bionic	needs-triage
jammy	dne
noble	dne
questing	dne
resolute	dne

mariadb-10.3

focal	needs-triage
jammy	dne
noble	dne
questing	dne
resolute	dne

mariadb-10.6

jammy	needs-triage
noble	dne
questing	dne
resolute	dne

openSUSE / SLES Releases

openSUSE Product

Release

libmariadbd-devel

suse enterprise sap 15 SP4	10.6.24-150400.3.43.1 fixed
suse enterprise sap 15 SP5	10.6.24-150400.3.43.1 fixed
suse enterprise sap 15 SP7	11.8.5-150700.3.9.1 fixed
suse enterprise server 15 SP2	10.4.34-150200.3.54.1 fixed
suse enterprise server 15 SP3	10.5.29-150300.3.55.1 fixed
suse enterprise server 15 SP4	10.6.24-150400.3.43.1 fixed
suse enterprise server 15 SP5	10.6.24-150400.3.43.1 fixed
suse enterprise server 15 SP6	10.11.15-150600.4.17.1 fixed
suse enterprise server 15 SP7	11.8.5-150700.3.9.1 fixed

libmariadbd19

suse enterprise sap 15 SP4	10.6.24-150400.3.43.1 fixed
suse enterprise sap 15 SP5	10.6.24-150400.3.43.1 fixed
suse enterprise sap 15 SP7	11.8.5-150700.3.9.1 fixed
suse enterprise server 15 SP2	10.4.34-150200.3.54.1 fixed
suse enterprise server 15 SP3	10.5.29-150300.3.55.1 fixed
suse enterprise server 15 SP4	10.6.24-150400.3.43.1 fixed
suse enterprise server 15 SP5	10.6.24-150400.3.43.1 fixed
suse enterprise server 15 SP6	10.11.15-150600.4.17.1 fixed
suse enterprise server 15 SP7	11.8.5-150700.3.9.1 fixed

mariadb

suse enterprise sap 15 SP4	10.6.24-150400.3.43.1 fixed
suse enterprise sap 15 SP5	10.6.24-150400.3.43.1 fixed
suse enterprise sap 15 SP7	11.8.5-150700.3.9.1 fixed
suse enterprise server 12 SP5	10.2.44-3.56.1 fixed
suse enterprise server 15 SP2	10.4.34-150200.3.54.1 fixed
suse enterprise server 15 SP3	10.5.29-150300.3.55.1 fixed
suse enterprise server 15 SP4	10.6.24-150400.3.43.1 fixed
suse enterprise server 15 SP5	10.6.24-150400.3.43.1 fixed
suse enterprise server 15 SP6	10.11.15-150600.4.17.1 fixed
suse enterprise server 15 SP7	11.8.5-150700.3.9.1 fixed

mariadb-client

suse enterprise sap 15 SP4	10.6.24-150400.3.43.1 fixed
suse enterprise sap 15 SP5	10.6.24-150400.3.43.1 fixed
suse enterprise sap 15 SP7	11.8.5-150700.3.9.1 fixed
suse enterprise server 12 SP5	10.2.44-3.56.1 fixed
suse enterprise server 15 SP2	10.4.34-150200.3.54.1 fixed
suse enterprise server 15 SP3	10.5.29-150300.3.55.1 fixed
suse enterprise server 15 SP4	10.6.24-150400.3.43.1 fixed
suse enterprise server 15 SP5	10.6.24-150400.3.43.1 fixed
suse enterprise server 15 SP6	10.11.15-150600.4.17.1 fixed
suse enterprise server 15 SP7	11.8.5-150700.3.9.1 fixed

mariadb-errormessages

suse enterprise sap 15 SP4	10.6.24-150400.3.43.1 fixed
suse enterprise sap 15 SP5	10.6.24-150400.3.43.1 fixed
suse enterprise sap 15 SP7	11.8.5-150700.3.9.1 fixed
suse enterprise server 12 SP5	10.2.44-3.56.1 fixed
suse enterprise server 15 SP2	10.4.34-150200.3.54.1 fixed
suse enterprise server 15 SP3	10.5.29-150300.3.55.1 fixed
suse enterprise server 15 SP4	10.6.24-150400.3.43.1 fixed
suse enterprise server 15 SP5	10.6.24-150400.3.43.1 fixed
suse enterprise server 15 SP6	10.11.15-150600.4.17.1 fixed
suse enterprise server 15 SP7	11.8.5-150700.3.9.1 fixed

mariadb-tools

suse enterprise sap 15 SP4	10.6.24-150400.3.43.1 fixed
suse enterprise sap 15 SP5	10.6.24-150400.3.43.1 fixed
suse enterprise sap 15 SP7	11.8.5-150700.3.9.1 fixed
suse enterprise server 12 SP5	10.2.44-3.56.1 fixed
suse enterprise server 15 SP2	10.4.34-150200.3.54.1 fixed
suse enterprise server 15 SP3	10.5.29-150300.3.55.1 fixed
suse enterprise server 15 SP4	10.6.24-150400.3.43.1 fixed
suse enterprise server 15 SP5	10.6.24-150400.3.43.1 fixed
suse enterprise server 15 SP6	10.11.15-150600.4.17.1 fixed
suse enterprise server 15 SP7	11.8.5-150700.3.9.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

mariadb

RHEL 9

3:10.5.29-3.el9_7

fixed

mariadb-backup

RHEL 9

3:10.5.29-3.el9_7

fixed

mariadb-common

RHEL 9

3:10.5.29-3.el9_7

fixed

mariadb-devel

RHEL 9

3:10.5.29-3.el9_7

fixed

mariadb-embedded

RHEL 9

3:10.5.29-3.el9_7

fixed

mariadb-embedded-devel

RHEL 9

3:10.5.29-3.el9_7

fixed

mariadb-errmsg

RHEL 9

3:10.5.29-3.el9_7

fixed

mariadb-gssapi-server

RHEL 9

3:10.5.29-3.el9_7

fixed

mariadb-oqgraph-engine

RHEL 9

3:10.5.29-3.el9_7

fixed

mariadb-pam

RHEL 9

3:10.5.29-3.el9_7

fixed

mariadb-server

RHEL 9

3:10.5.29-3.el9_7

fixed

mariadb-server-galera

RHEL 9

3:10.5.29-3.el9_7

fixed

mariadb-server-utils

RHEL 9

3:10.5.29-3.el9_7

fixed

mariadb-test

RHEL 9

3:10.5.29-3.el9_7

fixed

Amazon Linux Releases

Amazon Package

Release

mariadb1011

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-backup

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-backup-debuginfo

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-client-utils

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-common

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-connect-engine

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-connect-engine-debuginfo

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-cracklib-password-check

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-cracklib-password-check-debuginfo

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-debuginfo

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-debugsource

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-devel

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-errmsg

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-gssapi-server

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-gssapi-server-debuginfo

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-oqgraph-engine

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-oqgraph-engine-debuginfo

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-pam

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-pam-debuginfo

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-rocksdb-engine

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-rocksdb-engine-debuginfo

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-server

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-server-debuginfo

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-server-utils

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-server-utils-debuginfo

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-sphinx-engine

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-sphinx-engine-debuginfo

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-test

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

mariadb1011-test-debuginfo

Amazon Linux 2023

3:10.11.15-1.amzn2023.0.1

fixed

Azure Linux Releases

Azure Package

Release

mariadb

Azure Linux 3.0	0:10.11.15-1.azl3 fixed
CBL-Mariner 2.0	0:10.6.24-1.cm2 fixed

Common Weakness Enumeration

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References

https://jira.mariadb.org/browse/MDEV-37483

https://www.zerodayinitiative.com/advisories/ZDI-25-1025/