CVE-2025-13699

EUVD-2025-204966

23.12.2025, 22:15

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000.

Path Traversal

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
zdi	CNA	7 HIGH	LOCAL	HIGH	NONE	CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
mariadb	mariadb	11.8.3	CNA

Debian Releases

Debian Product

Codename

mariadb

bookworm	vulnerable
bullseye	postponed
forky	1:11.8.6-5 fixed
sid	1:11.8.6-5 fixed
trixie	1:11.8.6-0+deb13u1 fixed

mariadb-10.5

bookworm	no-dsa
bullseye	vulnerable
bullseye (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

mariadb

jammy	dne
noble	needs-triage
plucky	ignored
questing	needs-triage

mariadb-10.0

jammy	dne
noble	dne
questing	dne
xenial	needs-triage

mariadb-10.1

bionic	needs-triage
jammy	dne
noble	dne
questing	dne

mariadb-10.3

focal	needs-triage
jammy	dne
noble	dne
questing	dne

mariadb-10.6

jammy	needs-triage
noble	dne
questing	dne

Common Weakness Enumeration

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References

https://jira.mariadb.org/browse/MDEV-37483

https://www.zerodayinitiative.com/advisories/ZDI-25-1025/