During a state snapshot transfer the donor MariaDB server interpolates parameters supplied by a joining node into shell commands without proper validation. The flaw allows an attacker to inject arbitrary shell commands that will execute on the donor machine. The weakness corresponds to CWE‑78, which concerns exploitation through command injection.

The vulnerability affects MariaDB Server community editions from "10.6.1 to before 10.6.27", "10.11.1 to before 10.11.18", "11.4.1 to before 11.4.12", "11.8.1 to before 11.8.8", and the standalone release 12.3.1. Updated releases—10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2—contain the fix.

The CVSS score of 8 indicates critical severity, while the EPSS score of less than 1% suggests that, so far, exploitation has been rare or unheard of. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to control or compromise a node that initiates a replication join and supply specially crafted parameters during the rsync state snapshot transfer. Successful exploitation would enable remote code execution on the donor node, allowing the attacker to gain full administrative access to the database server.