The flaw lies in MariaDB server’s service unit, which processes the /run/mysqld/wsrep-new-cluster file when the service restarts. A database user with FILE privilege, together with a secure-file-priv setting that allows writes to /run/mysqld, can create this file and inject attacker‑controlled environment variables. This flaw is a classic example of the improper access control weakness identified by CWE‑15. Based on the description, injecting such values can lead to execution of arbitrary commands under the MariaDB service account, effectively providing local privilege escalation on the host.

MariaDB server versions earlier than 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 are affected. The issue is fixed in the corresponding releases.

The CVSS score of 8.4 indicates a high‑severity flaw. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting that widespread exploitation has not yet been observed. Nonetheless, because an attacker only needs FILE privilege and a permissive secure‑file‑priv configuration, an adversary could elevate privileges locally by injecting environment values into the MariaDB service process. This risk increases if the service runs with elevated privileges, so prompt remediation is strongly advised.