During a standard state transfer, the donor node interpolates parameters received from the joiner into the command line used by the mariabackup SST method. Because several parameters were not properly validated, a malicious joiner can supply crafted values that cause the donor to execute arbitrary shell commands. The flaw is a classic command injection (CWE‑78) and gives the attacker full code execution on the donor server, potentially compromising the entire cluster and any data the server holds.

MariaDB Server products in the 10.6, 10.11, 11.4, 11.8, and 12.3 branches are affected. Specifically, versions 10.6.1 through 10.6.25, 10.11.1 through 10.11.16, 11.4.1 through 11.4.10, 11.8.1 through 11.8.6, and 12.3.1 are vulnerable. These issues were fixed in 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

The vulnerability carries a CVSS score of 8, indicating high severity. The EPSS score is less than 1%, suggesting that exploitation attempts are currently rare, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need the ability to act as a cluster joiner, which typically requires internal network access or a compromised client. If exploited, the attacker achieves full code execution on the donor, enabling data exfiltration, privilege escalation, or further lateral movement across the cluster.