MariaDB server allows the ALTER TABLE ... CONVERT ... PARTITION statement to construct file paths from partition names without applying filename escaping. An authenticated user can specify a partition name that expands to a path outside the table’s data directory, causing the conversion to read or modify files that belong to other tables. This enables an attacker to read data they are not authorized to see or corrupt table files, resulting in unauthorized data disclosure or integrity compromise.

MariaDB server versions 10.11.1 through 10.11.18, all 11.4.x releases earlier than 11.4.13, all 11.8.x releases earlier than 11.8.9, all 12.3.x releases earlier than 12.3.3, and all 13.0.x releases earlier than 13.0.2 are affected. The issue has been fixed in MariaDB 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2 and later.

The vulnerability carries a CVSS score of 8, indicating high severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attack requires an authenticated user with privileges to execute ALTER TABLE commands; the most likely attack vector is through an SQL query executed over the database interface. Because the issue involves authorization bypass, an attacker with such privileges can read or modify data in tables they normally cannot access, potentially impacting data confidentiality and integrity.