UnratedFix available

DEBIAN-CVE-2026-44171

Type: advisorySource: OSV1 source record

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

Announced 12 Jun 2026Source revision 1

Original source ↗

DEBIAN-CVE-2026-44171

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-44171

mariadb

Source reference: /affected/0/package/name

Affected versions: 1:10.11.11-0+deb12u1
Source reference: /affected/0/versions
1:10.11.13-0+deb12u1
Source reference: /affected/0/versions
1:10.11.14-0+deb12u1
Source reference: /affected/0/versions
1:10.11.14-0+deb12u2
Source reference: /affected/0/versions
1:10.11.3-1
Source reference: /affected/0/versions
1:10.11.3-2~exp1
Source reference: /affected/0/versions
1:10.11.4-1
Source reference: /affected/0/versions
1:10.11.4-1~deb12u1
Source reference: /affected/0/versions
1:10.11.5-1
Source reference: /affected/0/versions
1:10.11.5-2
Source reference: /affected/0/versions
1:10.11.5-3
Source reference: /affected/0/versions
1:10.11.6-0+deb12u1
Source reference: /affected/0/versions
1:10.11.6-1
Source reference: /affected/0/versions
1:10.11.6-2
Source reference: /affected/0/versions
1:10.11.6-2.1~exp1
Source reference: /affected/0/versions
1:10.11.7-1
Source reference: /affected/0/versions
1:10.11.7-2
Source reference: /affected/0/versions
1:10.11.7-3
Source reference: /affected/0/versions
1:10.11.7-4
Source reference: /affected/0/versions
1:10.11.8-1
Source reference: /affected/0/versions
1:10.11.9-0+deb12u1
Source reference: /affected/0/versions
Fixed versions: 1:10.11.18-0+deb12u1
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

mariadb

Source reference: /affected/1/package/name

Affected versions: 1:11.8.2-1
Source reference: /affected/1/versions
1:11.8.3-0+deb13u1
Source reference: /affected/1/versions
1:11.8.3-1
Source reference: /affected/1/versions
1:11.8.5-1
Source reference: /affected/1/versions
1:11.8.5-2
Source reference: /affected/1/versions
1:11.8.5-3
Source reference: /affected/1/versions
1:11.8.5-3~exp1
Source reference: /affected/1/versions
1:11.8.5-3~exp2
Source reference: /affected/1/versions
1:11.8.5-3~exp3
Source reference: /affected/1/versions
1:11.8.5-4
Source reference: /affected/1/versions
1:11.8.6-0+deb13u1
Source reference: /affected/1/versions
1:11.8.6-1
Source reference: /affected/1/versions
1:11.8.6-2
Source reference: /affected/1/versions
1:11.8.6-3
Source reference: /affected/1/versions
1:11.8.6-4
Source reference: /affected/1/versions
1:11.8.6-5
Source reference: /affected/1/versions
1:11.8.6-6
Source reference: /affected/1/versions
1:11.8.8-0+deb13u1
Source reference: /affected/1/versions
1:11.8.8-1
Source reference: /affected/1/versions
1:11.8.9+ds-1
Source reference: /affected/1/versions
1:11.8.9+ds-2
Source reference: /affected/1/versions
1:11.8.9+ds-3
Source reference: /affected/1/versions
1:11.8.9+ds-4
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

mariadb

Source reference: /affected/2/package/name

Affected versions: 1:11.8.2-1
Source reference: /affected/2/versions
1:11.8.3-1
Source reference: /affected/2/versions
1:11.8.5-1
Source reference: /affected/2/versions
1:11.8.5-2
Source reference: /affected/2/versions
1:11.8.5-3
Source reference: /affected/2/versions
1:11.8.5-3~exp1
Source reference: /affected/2/versions
1:11.8.5-3~exp2
Source reference: /affected/2/versions
1:11.8.5-3~exp3
Source reference: /affected/2/versions
1:11.8.5-4
Source reference: /affected/2/versions
1:11.8.6-1
Source reference: /affected/2/versions
1:11.8.6-2
Source reference: /affected/2/versions
1:11.8.6-3
Source reference: /affected/2/versions
1:11.8.6-4
Source reference: /affected/2/versions
1:11.8.6-5
Source reference: /affected/2/versions
1:11.8.6-6
Source reference: /affected/2/versions
Fixed versions: 1:11.8.8-1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:10.11.18-0+deb12u1"
          }
        ]
      }
    ],
    "package": {
      "name": "mariadb",
      "purl": "pkg:deb/debian/mariadb?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "1:10.11.11-0+deb12u1",
      "1:10.11.13-0+deb12u1",
      "1:10.11.14-0+deb12u1",
      "1:10.11.14-0+deb12u2",
      "1:10.11.3-1",
      "1:10.11.3-2~exp1",
      "1:10.11.4-1",
      "1:10.11.4-1~deb12u1",
      "1:10.11.5-1",
      "1:10.11.5-2",
      "1:10.11.5-3",
      "1:10.11.6-0+deb12u1",
      "1:10.11.6-1",
      "1:10.11.6-2",
      "1:10.11.6-2.1~exp1",
      "1:10.11.7-1",
      "1:10.11.7-2",
      "1:10.11.7-3",
      "1:10.11.7-4",
      "1:10.11.8-1",
      "1:10.11.9-0+deb12u1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44171.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "mariadb",
      "purl": "pkg:deb/debian/mariadb?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "1:11.8.2-1",
      "1:11.8.3-0+deb13u1",
      "1:11.8.3-1",
      "1:11.8.5-1",
      "1:11.8.5-2",
      "1:11.8.5-3",
      "1:11.8.5-3~exp1",
      "1:11.8.5-3~exp2",
      "1:11.8.5-3~exp3",
      "1:11.8.5-4",
      "1:11.8.6-0+deb13u1",
      "1:11.8.6-1",
      "1:11.8.6-2",
      "1:11.8.6-3",
      "1:11.8.6-4",
      "1:11.8.6-5",
      "1:11.8.6-6",
      "1:11.8.8-0+deb13u1",
      "1:11.8.8-1",
      "1:11.8.9+ds-1",
      "1:11.8.9+ds-2",
      "1:11.8.9+ds-3",
      "1:11.8.9+ds-4"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44171.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:11.8.8-1"
          }
        ]
      }
    ],
    "package": {
      "name": "mariadb",
      "purl": "pkg:deb/debian/mariadb?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "1:11.8.2-1",
      "1:11.8.3-1",
      "1:11.8.5-1",
      "1:11.8.5-2",
      "1:11.8.5-3",
      "1:11.8.5-3~exp1",
      "1:11.8.5-3~exp2",
      "1:11.8.5-3~exp3",
      "1:11.8.5-4",
      "1:11.8.6-1",
      "1:11.8.6-2",
      "1:11.8.6-3",
      "1:11.8.6-4",
      "1:11.8.6-5",
      "1:11.8.6-6"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44171.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #57054 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 16:59:44 GMT
Publisher date: Fri, 12 Jun 2026 18:16:33 GMT

Read the original announcement