CVE-2026-44173

Low

No strong exploitation signal.

CVSS base

5.0 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

EPSS — probability of exploitation (30 days)

0.6%

48.3th percentile

CISA KEV

Not listed

Weakness / dates

CWE-266

Published 2026-06-12 · modified 2026-08-03

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Attack Vector	N	Network
Attack Complexity	L	Low
Privileges Required	L	Low
User Interaction	N	None
Scope	C	Changed
Confidentiality	N	None
Integrity	N	None
Availability	L	Low

Timeline

2026-06-12 — Published (NVD)
2026-08-03 — Last modified (NVD)

Description

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

Affected

mariadb

References

Official: NVD · CVE.org