The vulnerability in MariaDB Server arises when the CONNECT engine’s CONNECT REST module interpolates the table HTTP attribute directly into a curl command executed on Windows. Because the URL value is not sanitized, an attacker can inject arbitrary shell commands into that curl invocation, resulting in remote code execution. This flaw is classified as CWE-78, and it allows an adversary to run any code with the privileges of the MariaDB process, potentially leading to full system compromise, data exfiltration, or pivot to other services.

MariaDB Server on Windows that has the CONNECT engine and REST support enabled is affected. The vulnerability applies to releases 10.6.1 through 10.6.25, 10.11.1 through 10.11.16, 11.4.1 through 11.4.10, 11.8.1 through 11.8.6, and the single release 12.3.1. All other MariaDB versions and non‑Windows platforms are not listed as vulnerable.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a low probability of exploitation in the wild. The likely attack vector is a crafted REST request that delivers a malicious URL containing shell commands; this inference is drawn from the description that the vulnerable value is interpolated into a curl command line. Exploitation would require the REST service to be reachable or an attacker to possess authentication credentials for the MariaDB server. Successful exploitation grants remote command execution with MariaDB process privileges, which can elevate to full control over the Windows host.