UnratedFix available

DEBIAN-CVE-2026-48163

Type: advisorySource: OSV1 source record

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

Announced 12 Jun 2026Source revision 1

Original source ↗

DEBIAN-CVE-2026-48163

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-48163

mariadb

Source reference: /affected/0/package/name

Affected versions: 1:10.11.11-0+deb12u1
Source reference: /affected/0/versions
1:10.11.13-0+deb12u1
Source reference: /affected/0/versions
1:10.11.14-0+deb12u1
Source reference: /affected/0/versions
1:10.11.14-0+deb12u2
Source reference: /affected/0/versions
1:10.11.3-1
Source reference: /affected/0/versions
1:10.11.3-2~exp1
Source reference: /affected/0/versions
1:10.11.4-1
Source reference: /affected/0/versions
1:10.11.4-1~deb12u1
Source reference: /affected/0/versions
1:10.11.5-1
Source reference: /affected/0/versions
1:10.11.5-2
Source reference: /affected/0/versions
1:10.11.5-3
Source reference: /affected/0/versions
1:10.11.6-0+deb12u1
Source reference: /affected/0/versions
1:10.11.6-1
Source reference: /affected/0/versions
1:10.11.6-2
Source reference: /affected/0/versions
1:10.11.6-2.1~exp1
Source reference: /affected/0/versions
1:10.11.7-1
Source reference: /affected/0/versions
1:10.11.7-2
Source reference: /affected/0/versions
1:10.11.7-3
Source reference: /affected/0/versions
1:10.11.7-4
Source reference: /affected/0/versions
1:10.11.8-1
Source reference: /affected/0/versions
1:10.11.9-0+deb12u1
Source reference: /affected/0/versions
Fixed versions: 1:10.11.18-0+deb12u1
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

mariadb

Source reference: /affected/1/package/name

Affected versions: 1:11.8.2-1
Source reference: /affected/1/versions
1:11.8.3-0+deb13u1
Source reference: /affected/1/versions
1:11.8.3-1
Source reference: /affected/1/versions
1:11.8.5-1
Source reference: /affected/1/versions
1:11.8.5-2
Source reference: /affected/1/versions
1:11.8.5-3
Source reference: /affected/1/versions
1:11.8.5-3~exp1
Source reference: /affected/1/versions
1:11.8.5-3~exp2
Source reference: /affected/1/versions
1:11.8.5-3~exp3
Source reference: /affected/1/versions
1:11.8.5-4
Source reference: /affected/1/versions
1:11.8.6-0+deb13u1
Source reference: /affected/1/versions
1:11.8.6-1
Source reference: /affected/1/versions
1:11.8.6-2
Source reference: /affected/1/versions
1:11.8.6-3
Source reference: /affected/1/versions
1:11.8.6-4
Source reference: /affected/1/versions
1:11.8.6-5
Source reference: /affected/1/versions
1:11.8.6-6
Source reference: /affected/1/versions
1:11.8.8-0+deb13u1
Source reference: /affected/1/versions
1:11.8.8-1
Source reference: /affected/1/versions
1:11.8.9+ds-1
Source reference: /affected/1/versions
1:11.8.9+ds-2
Source reference: /affected/1/versions
1:11.8.9+ds-3
Source reference: /affected/1/versions
1:11.8.9+ds-4
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

mariadb

Source reference: /affected/2/package/name

Affected versions: 1:11.8.2-1
Source reference: /affected/2/versions
1:11.8.3-1
Source reference: /affected/2/versions
1:11.8.5-1
Source reference: /affected/2/versions
1:11.8.5-2
Source reference: /affected/2/versions
1:11.8.5-3
Source reference: /affected/2/versions
1:11.8.5-3~exp1
Source reference: /affected/2/versions
1:11.8.5-3~exp2
Source reference: /affected/2/versions
1:11.8.5-3~exp3
Source reference: /affected/2/versions
1:11.8.5-4
Source reference: /affected/2/versions
1:11.8.6-1
Source reference: /affected/2/versions
1:11.8.6-2
Source reference: /affected/2/versions
1:11.8.6-3
Source reference: /affected/2/versions
1:11.8.6-4
Source reference: /affected/2/versions
1:11.8.6-5
Source reference: /affected/2/versions
1:11.8.6-6
Source reference: /affected/2/versions
Fixed versions: 1:11.8.8-1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:10.11.18-0+deb12u1"
          }
        ]
      }
    ],
    "package": {
      "name": "mariadb",
      "purl": "pkg:deb/debian/mariadb?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "1:10.11.11-0+deb12u1",
      "1:10.11.13-0+deb12u1",
      "1:10.11.14-0+deb12u1",
      "1:10.11.14-0+deb12u2",
      "1:10.11.3-1",
      "1:10.11.3-2~exp1",
      "1:10.11.4-1",
      "1:10.11.4-1~deb12u1",
      "1:10.11.5-1",
      "1:10.11.5-2",
      "1:10.11.5-3",
      "1:10.11.6-0+deb12u1",
      "1:10.11.6-1",
      "1:10.11.6-2",
      "1:10.11.6-2.1~exp1",
      "1:10.11.7-1",
      "1:10.11.7-2",
      "1:10.11.7-3",
      "1:10.11.7-4",
      "1:10.11.8-1",
      "1:10.11.9-0+deb12u1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48163.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "mariadb",
      "purl": "pkg:deb/debian/mariadb?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "1:11.8.2-1",
      "1:11.8.3-0+deb13u1",
      "1:11.8.3-1",
      "1:11.8.5-1",
      "1:11.8.5-2",
      "1:11.8.5-3",
      "1:11.8.5-3~exp1",
      "1:11.8.5-3~exp2",
      "1:11.8.5-3~exp3",
      "1:11.8.5-4",
      "1:11.8.6-0+deb13u1",
      "1:11.8.6-1",
      "1:11.8.6-2",
      "1:11.8.6-3",
      "1:11.8.6-4",
      "1:11.8.6-5",
      "1:11.8.6-6",
      "1:11.8.8-0+deb13u1",
      "1:11.8.8-1",
      "1:11.8.9+ds-1",
      "1:11.8.9+ds-2",
      "1:11.8.9+ds-3",
      "1:11.8.9+ds-4"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48163.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:11.8.8-1"
          }
        ]
      }
    ],
    "package": {
      "name": "mariadb",
      "purl": "pkg:deb/debian/mariadb?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "1:11.8.2-1",
      "1:11.8.3-1",
      "1:11.8.5-1",
      "1:11.8.5-2",
      "1:11.8.5-3",
      "1:11.8.5-3~exp1",
      "1:11.8.5-3~exp2",
      "1:11.8.5-3~exp3",
      "1:11.8.5-4",
      "1:11.8.6-1",
      "1:11.8.6-2",
      "1:11.8.6-3",
      "1:11.8.6-4",
      "1:11.8.6-5",
      "1:11.8.6-6"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48163.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #57156 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 17:04:30 GMT
Publisher date: Fri, 12 Jun 2026 18:16:35 GMT

Read the original announcement