MariaDB Server: Table name encoding bypass via #mysql50# prefix allows file access

Summary

The #mysql50# prefix in MariaDB Server lets a table name skip the normal filesystem encoding, so it can point to files under their legacy unencoded names. An authenticated user who can create or manipulate table names can trigger this to cause crashes, data corruption, data exfiltration and, according to the vendor, remote code execution. The vendor rates the issue as Critical (CVSS 9.9) and the scope as changed, so the impact can reach beyond the database itself.

Affected

• MariaDB Server 10.6.1 to 10.6.27
• MariaDB Server 10.11.1 to 10.11.18
• MariaDB Server 11.4.1 to 11.4.12
• MariaDB Server 11.8.1 to 11.8.8
• MariaDB Server 12.3.1 to 12.3.2
• MariaDB Server 13.0.1
• Earlier branches: Unknown.

Fixed in

• 10.6.28
• 10.11.19
• 11.4.13
• 11.8.9
• 12.3.3
• 13.0.2
• Distribution and Enterprise Server builds may use their own numbering and backports; check your vendor's advisories.

Workaround

The vendor states that there is no workaround. Upgrade to a fixed version.

Exploitation

• CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
• No reports of active exploitation were found in the research notes. The CISA KEV catalogue was not checked.
• Public proof-of-concept code is reported by some sources but not by others. The public code reportedly shows cache confusion between prefixed and unprefixed names, but not a path to code execution.

Our recommendation

• Upgrade MariaDB Server to a fixed version without delay, including on test and internal systems.
• Verify installed package versions, not only the presence of MariaDB, and check distribution or Enterprise Server advisories.
• Restrict CREATE and ALTER TABLE privileges to the accounts that need them, and review application features that let users influence table names.
• Keep the database port off the internet and off untrusted networks.
• Review logs for table names containing #mysql50#, bearing in mind that the prefix has legitimate uses.
• Give priority to internet-reachable, multi-tenant and shared-host systems.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  SeanDishman/mariadb-cve-2026-92262

Research sources

• MariaDB security advisory GHSA-65jj-h265-3m7h github.com
• MDEV-40362 Jira issue jira.mariadb.org
• MariaDB 10.6.28 release github.com
• MariaDB 10.11.19 release github.com
• MariaDB 11.4.13 release github.com
• MariaDB 11.8.9 release github.com
• MariaDB 12.3.3 release github.com
• MariaDB 13.0.2 release github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:16.