MariaDB allows the SELECT … INTO OUTFILE or SELECT … INTO DUMPFILE statements to write a file when the FROM clause contains only subqueries, without checking that the caller has the FILE privilege. This omission lets an attacker with SELECT rights create or overwrite arbitrary files on the database server, potentially enabling further compromise or persistence. The flaw is a violation of proper access control (CWE‑863).

MariaDB server versions 10.6.1 through 10.6.25, 10.11.1 through 10.11.16, 11.4.1 through 11.4.10, 11.8.1 through 11.8.6, and 12.3.1 are affected. The issue was fixed in 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

The CVSS score of 5 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation. The vulnerability is not listed in CISA KEV, and publicly known exploitation is not reported. Real‑world impact would require an attacker to have database SELECT privileges; there is no remote code execution vector, but the ability to write arbitrary files could lead to privilege escalation or other attacks if privileged directories are writable.