Bypass Table Name Filesystem Encoding in MariaDB Server
CVE-2026-92262
9.9CRITICAL
What is CVE-2026-92262?
A vulnerability exists in MariaDB Server wherein the use of the #mysql50# prefix allows an attacker to circumvent normal filesystem encoding for table names. This can result in unauthorized access to files under their legacy unencoded names, potentially leading to severe outcomes such as crashes, data corruption, and unauthorized data exfiltration or execution of arbitrary code. The issue impacts versions prior to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, and has been addressed with updates to these versions.
Affected Version(s)
server >= 10.6.1, < 10.6.28 < 10.6.1, 10.6.28
server >= 10.11.1, < 10.11.19 < 10.11.1, 10.11.19
server >= 11.4.1, < 11.4.13 < 11.4.1, 11.4.13