CVE-2025-13699: MariaDB mariadb-dump RCE Vulnerability

CVE-2025-13699 Overview

CVE-2025-13699 is a directory traversal vulnerability in the MariaDB mariadb-dump utility that can lead to remote code execution. The flaw exists in how the utility handles view names, where user-supplied paths are used in file operations without proper validation. An attacker who can influence view names processed by mariadb-dump can write files to arbitrary locations and execute code in the context of the current user. The issue was reported through the Zero Day Initiative as ZDI-CAN-27000 and tracked by MariaDB as MDEV-37483. Exploitation requires user interaction with the mariadb-dump utility, and attack vectors depend on how the tool is integrated into backup workflows.

Critical Impact
Successful exploitation allows arbitrary code execution in the context of the user running mariadb-dump, classified under [CWE-22] Path Traversal.

Affected Products

MariaDB Server (versions shipping the affected mariadb-dump utility)
MariaDB mariadb-dump client utility
Deployments using mariadb-dump for backup or replication workflows

Discovery Timeline

2025-12-23 - CVE-2025-13699 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13699

Vulnerability Analysis

The vulnerability resides in the mariadb-dump client utility, which produces logical backups of MariaDB databases. During the dump process, the utility iterates over database objects including views, and constructs file paths using object names supplied by the server. The view name handling routine fails to sanitize path components, allowing characters such as ../ or absolute path separators to influence the resulting file path. When the utility writes dump output or auxiliary files based on a malicious view name, the write operation lands outside the intended directory.

Because mariadb-dump is frequently executed by privileged users such as root, database administrators, or automated backup service accounts, an attacker who controls view names in a target database can place attacker-chosen content into sensitive locations. Writing to startup scripts, cron directories, or shell configuration files converts the file write into code execution.

Root Cause

The root cause is missing path validation in the mariadb-dump view name handling logic. The utility trusts metadata returned from the server and passes it directly into file operations. The vulnerability is classified as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

The attack requires local execution of mariadb-dump against a database where the attacker has previously created or renamed a view containing traversal sequences. When an administrator dumps that database, the utility processes the malicious view name and writes attacker-controlled content to a path of the attacker's choosing. Attack complexity is high because the attacker must influence database content and induce a user to run the dump. Refer to the Zero Day Initiative Advisory ZDI-25-1025 and MariaDB Issue MDEV-37483 for additional technical context.

Detection Methods for CVE-2025-13699

Indicators of Compromise

View objects in MariaDB databases whose names contain path traversal sequences such as ../ or absolute path characters
Files created in unexpected locations following execution of mariadb-dump, particularly in directories such as /etc/cron.d/, /root/.ssh/, or user shell startup files
Audit log entries showing CREATE VIEW or RENAME statements producing unusually structured view names

Detection Strategies

Inspect information_schema.VIEWS for TABLE_NAME values containing path separators or traversal sequences
Monitor invocations of mariadb-dump and correlate them with subsequent file writes outside the expected output directory
Alert on database schema changes that introduce views with non-alphanumeric characters in their names

Monitoring Recommendations

Enable filesystem auditing on hosts that run scheduled mariadb-dump jobs and review writes performed by the backup user account
Forward MariaDB general query log and audit plugin output to a centralized SIEM for review of view creation activity
Track process execution of mariadb-dump and capture command-line arguments to identify the targeted databases

How to Mitigate CVE-2025-13699

Immediate Actions Required

Apply the fix tracked in MariaDB Issue MDEV-37483 once available for your MariaDB branch
Audit existing databases for view names containing traversal characters and remove or rename suspicious objects
Restrict CREATE VIEW privileges to trusted database accounts only

Patch Information

MariaDB tracks the issue as MDEV-37483. Review the MariaDB Issue MDEV-37483 tracker for fixed version information and apply the updated mariadb-dump binary to all hosts that perform backups. The Zero Day Initiative advisory is published as ZDI-25-1025.

Workarounds

Run mariadb-dump from a dedicated unprivileged service account with write access limited to the backup destination directory
Execute backup jobs inside a restricted working directory using chroot, container isolation, or filesystem namespaces
Validate view names returned by SHOW FULL TABLES WHERE Table_type = 'VIEW' before invoking mariadb-dump
Avoid running mariadb-dump as root or any account with write access to system directories

bash

# Configuration example: restrict the backup user and working directory
useradd -r -s /usr/sbin/nologin mariabackup
install -d -o mariabackup -g mariabackup -m 0750 /var/backups/mariadb
sudo -u mariabackup /usr/bin/mariadb-dump \
  --user=backup --password \
  --result-file=/var/backups/mariadb/dump.sql \
  --databases appdb