MariaDB Server: Insecure home directory of mysql account in RPM packages
Summary
MariaDB RPM packages created the mysql service account with the database data directory as home directory. A database user with the FILE privilege can write startup dot-files such as .bash_profile into that directory, and these files run when an administrator opens a login shell for the mysql account. Debian and Ubuntu packages are not affected because they use /nonexistent as home directory. The attack requires an authenticated database user with the FILE privilege and an administrator action, so the flaw is local and not directly reachable over the network.
Affected
- MariaDB server RPM packages 10.6.1 to 10.6.27
- MariaDB server RPM packages 10.11.1 to 10.11.18
- MariaDB server RPM packages 11.4.1 to 11.4.12
- MariaDB server RPM packages 11.8.1 to 11.8.8
- MariaDB server RPM packages 12.3.1 to 12.3.2
- MariaDB server RPM packages 13.0.1
- Debian and Ubuntu packages are not affected
Fixed in
- 10.6.28
- 10.11.19
- 11.4.13
- 11.8.9
- 12.3.3
- 13.0.2
- Applying the update also resets the home directory of the existing mysql account.
Workaround
- Change the home directory of the mysql user to a path that mariadbd cannot write to, for example: usermod -d /nonexistent mysql
- Reduce the number of accounts with the FILE privilege (own inference, not a vendor recommendation).
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No evidence of exploitation in the wild found. CISA KEV not directly verified.
- No public proof of concept found.
Our recommendation
- Update RPM-based MariaDB installations to the fixed version of your branch.
- Review accounts with the FILE privilege and remove it where it is not needed.
- After patching, check the mysql home directory with: getent passwd mysql
- Restrict who can open a login shell as the mysql account.
- Prioritise affected RPM hosts in the next patch cycle; Debian and Ubuntu hosts need no action for this issue.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-m5gf-432r-g5jw github.com
- Fix commit d842d6e github.com
- MariaDB 11.4.13 release notes mariadb.com
- MariaDB 10.6.28 release github.com
- MariaDB 10.11.19 release github.com
- MariaDB 11.8.9 release github.com
- Amazon Linux ALAS advisory explore.alas.aws.amazon.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:41.
Original description (NVD)
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
NVD references (8)
- https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2
- https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19
- https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28
- https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13
- https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9
- https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3
- https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2
- https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.