CVE-2026-44171: MariaDB Path Traversal Vulnerability

CVE-2026-44171 Overview

CVE-2026-44171 is a path traversal vulnerability [CWE-22] affecting the mbstream utility in MariaDB server. The mbstream tool fails to validate /../ sequences in archive paths during unpack operations. A specially crafted backup archive can cause mbstream to write files outside the intended target-dir directory. The flaw affects MariaDB versions 10.6.1 through 12.3.1 across multiple release branches. MariaDB patched the issue in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

Critical Impact
An attacker who supplies a malicious mbstream archive to a privileged user or automated restore process can write arbitrary files outside the target directory, leading to local code execution or privilege escalation.

Affected Products

MariaDB versions 10.6.1 to before 10.6.26
MariaDB versions 10.11.1 to before 10.11.17, and 11.4.1 to before 11.4.11
MariaDB versions 11.8.1 to before 11.8.7, and 12.3.1

Discovery Timeline

2026-06-12 - CVE-2026-44171 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-44171

Vulnerability Analysis

The mbstream utility packs and unpacks MariaDB backup streams produced by mariabackup. During unpack, the tool reads file path entries from the archive header and creates the corresponding files under the user-supplied target-dir. The unpack routine does not sanitize or reject path components containing .. segments. An archive entry such as ../../etc/cron.d/payload resolves outside the target directory when concatenated with the base path.

A legitimate MariaDB backup never contains traversal sequences, so the missing check went unnoticed until reported through the MariaDB issue tracker as MDEV-39408. Exploitation requires the victim to unpack an attacker-supplied archive, which matches the UI:R user interaction requirement. The impact depends on the privileges of the process running mbstream, which is often a database administrator or restore service account.

Root Cause

The root cause is missing input validation on archive member paths during extraction. The mbstream extraction logic concatenates the archive-supplied filename with the target directory without canonicalizing the result or rejecting parent-directory references. This is a classic relative path traversal weakness tracked under [CWE-22].

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious mbstream archive containing entries with ../ sequences in their filenames. The attacker then convinces an administrator or automated process to unpack the archive using mbstream -x or an equivalent restore workflow. When the extraction runs, files are written to attacker-chosen locations such as /etc/, cron directories, SSH authorized_keys, or MariaDB plugin directories. Writing to such locations can yield code execution under the privileges of the extracting process.

No verified public exploit code is currently available. See the MariaDB GitHub Security Advisory GHSA-9pjh-5hhw-65v9 and MariaDB Issue MDEV-39408 for upstream technical details.

Detection Methods for CVE-2026-44171

Indicators of Compromise

Files appearing outside the expected target-dir shortly after an mbstream -x or mariabackup --prepare operation.
New or modified files in sensitive locations such as /etc/cron.d/, /root/.ssh/authorized_keys, or MariaDB plugin_dir following a restore.
mbstream archives sourced from untrusted locations, including email attachments, shared backup buckets, or third-party tickets.

Detection Strategies

Inspect mbstream archives before extraction with mbstream -l or equivalent listing tools and reject any entry whose path contains .. or starts with /.
Run extraction inside an empty, isolated directory and compare the resulting file tree against the expected MariaDB datadir layout.
Audit MariaDB server binary versions against the patched releases 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

Monitoring Recommendations

Enable Linux audit rules on writes to /etc/, cron paths, and user .ssh directories from processes named mbstream or mariabackup.
Forward filesystem and process telemetry from database hosts to a centralized analytics platform for correlation across restore events.
Alert on unexpected child processes spawned by the database service account in the minutes following a backup restore.

How to Mitigate CVE-2026-44171

Immediate Actions Required

Upgrade MariaDB to a fixed version: 10.6.26, 10.11.17, 11.4.11, 11.8.7, or 12.3.2.
Treat all mbstream archives from untrusted or external sources as hostile until inspected.
Restrict access to backup ingestion paths and the accounts permitted to invoke mbstream.

Patch Information

MariaDB published fixes in 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2. The patched mbstream rejects archive entries whose paths escape the target directory. Full details are in the MariaDB GitHub Security Advisory GHSA-9pjh-5hhw-65v9.

Workarounds

Extract mbstream archives only inside ephemeral, unprivileged containers or chroots that contain no sensitive paths.
List archive contents with mbstream -l and abort extraction when any entry contains .. or absolute paths.
Run mbstream under a dedicated low-privilege user account with no write access to system directories.

bash

# Configuration example: safe extraction wrapper
set -euo pipefail
ARCHIVE="$1"
TARGET="$(mktemp -d /var/tmp/mbstream.XXXXXX)"

# Reject archives containing traversal or absolute paths
if mbstream -l < "$ARCHIVE" | awk '{print $NF}' | grep -E '(^/|(^|/)\.\.(/|$))'; then
  echo "Unsafe archive entries detected. Aborting." >&2
  exit 1
fi

# Extract as a dedicated unprivileged user
sudo -u mariabackup mbstream -x -C "$TARGET" < "$ARCHIVE"