MariaDB server 10.6.1 through 12.3.1 contains a path‑traversal flaw in the mbstream archive extraction routine. The code fails to sanitize "/../" components, meaning a crafted backup archive could create files outside the intended restore directory. An attacker who can supply a malicious archive could thus overwrite critical files or place executable payloads, compromising confidentiality, integrity, or availability of the system.

The vulnerability affects MariaDB server versions 10.6.1‑10.6.25, 10.11.1‑10.11.16, 11.4.1‑11.4.10, 11.8.1‑11.8.6, and 12.3.1. Fixed releases are 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2 respectively.

The CVSS score of 6.3 indicates medium severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require the ability to supply a specially crafted backup archive, a step that is typically limited to environments where backups originate from the attacker or are not validated. Once the archive is processed by mbstream, the attacker can write arbitrary files to locations outside the restore target directory. This could lead to privilege escalation or persistence if critical system files are overwritten.