CVE-2026-107814

A flaw was found in MariaDB. The dedicated database service account was configured using the database data directory as its home directory. An authenticated database user with file-writing privileges could place malicious startup scripts into this directory. This could result in arbitrary code execution with the privileges of the service account when an administrator opens a login shell for that user.

This vulnerability is rated as an Important impact because an attacker can escape the database management system to execute arbitrary host commands under the service user's identity, resulting in a scope change from database to operating system. Standard RPM installations configure the daemon's system account with its home pointed to the data store location. A database account granted elevated privileges (specifically the FILE privilege) can write shell profile scripts into this path, which then trigger whenever a system administrator starts an interactive shell as that service user.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to the fixed version of MariaDB Server