CVE-2026-92262

Summary

A flaw in MariaDB allows attackers with database access to bypass table name encoding, enabling them to access arbitrary files on the filesystem through specially crafted table names with the #mysql50# prefix. This can lead to crashes, data corruption, exfiltration, or remote code execution.

Exploitability

Exploitation requires a database user account with sufficient privileges to create or manipulate tables, and is relatively straightforward once an attacker has access to the database server.

Blast radius

The impact could be severe across all MariaDB installations running versions between 10.6.1-10.6.27, 10.11.1-10.11.18, 11.4.1-11.4.12, 11.8.1-11.8.8, 12.3.1-12.3.2, and 13.0.1 or earlier, potentially affecting any application using these MariaDB versions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 immediately.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.