Skip to content
Fencer Intel
high 7.0

CVE-2025-13699 json

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability

published 10mo ago modified 23d ago also EUVD-2025-204966

cvss
7.0
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000.

Patch / fix

  • mariadb Debian 12 1:10.11.18-0+deb12u1
  • mariadb Debian 13 11.8.6-0+deb13u1
  • mariadb Debian 14 1:11.8.5-1

debian advisories DEBIAN-CVE-2025-13699

  • mariadb10.11 hummingbird 1 10.11.16-2.2.hum1
  • mariadb10.11-pam hummingbird 1 10.11.16-2.2.hum1
  • mariadb10.11-test hummingbird 1 10.11.16-2.2.hum1
  • mariadb10.11-backup hummingbird 1 10.11.16-2.2.hum1
  • mariadb10.11-common hummingbird 1 10.11.16-2.2.hum1
  • mariadb10.11-errmsg hummingbird 1 10.11.16-2.2.hum1
  • mariadb10.11-server hummingbird 1 10.11.16-2.2.hum1
  • mariadb10.11-embedded hummingbird 1 10.11.16-2.2.hum1

red hat advisories RHSA-2026:8812RHSA-2026:8813RHSA-2026:0698RHSA-2026:0376RHSA-2026:0367RHSA-2026:0357

  • mariadb SLES for SAP 15 SP6, SLES 15 SP6-LTSS, openSUSE Leap 15.6 10.11.15-150600.4.17.1
  • mariadb SLES for SAP applications 16.0, SLES 16.0 11.8.5-160000.1.1
  • mariadb SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +7 more 10.6.24-150400.3.43.1
  • mariadb SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 10.5.29-150300.3.55.1
  • mariadb SLE Module for Server Applications 15 SP7, SLE Module for Package Hub 15 SP7 11.8.5-150700.3.9.1
  • mariadb SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 10.2.44-3.56.1

suse advisories SUSE-SU-2025:4520-1SUSE-SU-2025:4502-1SUSE-SU-2026:20018-1SUSE-SU-2025:4493-1SUSE-SU-2025:4491-1SUSE-SU-2025:4438-1

  • mariadb openSUSE Leap 16.0 11.8.5-160000.1.1

opensuse advisories openSUSE-SU-2025:20175-1

  • Judy AlmaLinux 8 1.0.5-18.module_el8.6.0+2867+72759d2f
  • Judy AlmaLinux 8 1.0.5-18.module_el8.6.0+3138+72759d2f
  • galera AlmaLinux 8 25.3.37-1.module_el8.8.0+3609+204d4ab0
  • mariadb AlmaLinux 8 3:10.3.39-2.module_el8.10.0+4093+5130acef
  • mariadb-test AlmaLinux 8 3:10.3.39-2.module_el8.10.0+4093+5130acef
  • mariadb-backup AlmaLinux 8 3:10.3.39-2.module_el8.10.0+4093+5130acef
  • mariadb-common AlmaLinux 8 3:10.3.39-2.module_el8.10.0+4093+5130acef
  • mariadb-errmsg AlmaLinux 8 3:10.3.39-2.module_el8.10.0+4093+5130acef

almalinux advisories ALSA-2026:0225ALSA-2026:0232ALSA-2026:0233ALSA-2026:0247ALSA-2026:0136ALSA-2026:0137

  • asio Rocky Linux 8 1.10.8-7.module+el8.10.0+40062+b4bfe4b1
  • asio Rocky Linux 8 1.10.8-7.module+el8.5.0+777+18007c86
  • mariadb10.11 Rocky Linux 10 3:10.11.15-1.el10_1
  • galera Rocky Linux 9 26.4.20-1.module+el9.7.0+40024+12a6f3b4
  • mariadb Rocky Linux 9 3:10.11.15-1.module+el9.7.0+40065+b33d0971
  • Judy Rocky Linux 8 1.0.5-18.module+el8.10.0+40062+b4bfe4b1
  • Judy Rocky Linux 8 1.0.5-18.module+el8.10.0+1674+fa55eae9
  • Judy Rocky Linux 8 1.0.5-18.module+el8.4.0+427+adf35707

rocky linux advisories RLSA-2026:0698RLSA-2026:0136RLSA-2026:0247RLSA-2026:0225RLSA-2026:0232RLSA-2026:0233

  • mariadb Azure Linux 3.0 10.11.15-1
  • mariadb CBL-Mariner 2.0 10.6.24-1

azure linux advisories AZL-73186AZL-73190

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2025-13699 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-13699 updated cvss 7.0

mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation

  • Red Hat CodeReady Linux Builder EUS (v.9.4) mariadb-test 10.5.22-2.el9_4
    fixed: vendor fix RHSA-2026:0061
  • Red Hat CodeReady Linux Builder EUS (v.9.6) mariadb-test 10.5.29-3.el9_6
    fixed: vendor fix RHSA-2026:0111
  • Red Hat Enterprise Linux AppStream (v. 8) Judy 1.0.5-18.module+el8.9.0+19449+ad5852d3, Judy 1.0.5-18.module+el8.10.0+21221+7bee72c1, Judy 1.0.5-18.module+el8.10.0+22630+cacda3f1, galera 25.3.37-1.module+el8.9.0+19449+ad5852d3, galera 26.4.20-1.module+el8.10.0+22586+3d7c2ef3, galera 26.4.22-1.module+el8.10.0+23546+c942e1d0, +35 more
    fixed: vendor fix RHSA-2026:0232
  • Red Hat Enterprise Linux AppStream (v. 9) mariadb 10.5.29-3.el9_7, mariadb-pam 10.5.29-3.el9_7, mariadb-backup 10.5.29-3.el9_7, mariadb-common 10.5.29-3.el9_7, mariadb-errmsg 10.5.29-3.el9_7, mariadb-server 10.5.29-3.el9_7, +18 more
    fixed: vendor fix RHSA-2026:0247
  • Red Hat Enterprise Linux AppStream (v. 10) mariadb 10.11.15-1.el10_1, mariadb-pam 10.11.15-1.el10_1, mariadb-test 10.11.15-1.el10_1, mariadb10.11 10.11.15-1.el10_1, mariadb-backup 10.11.15-1.el10_1, mariadb-common 10.11.15-1.el10_1, +8 more
    fixed: vendor fix RHSA-2026:0136
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) Judy 1.0.5-18.module+el8+2765+cfa4f87b, galera 25.3.32-1.module+el8.2.0+10474+c7510d9c, mariadb 10.3.28-2.module+el8.2.0+23809+9df5005f, mariadb-test 10.3.28-2.module+el8.2.0+23809+9df5005f, mariadb-backup 10.3.28-2.module+el8.2.0+23809+9df5005f, mariadb-common 10.3.28-2.module+el8.2.0+23809+9df5005f, +7 more
    fixed: vendor fix RHSA-2026:0357
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) Judy 1.0.5-18.module+el8+2765+cfa4f87b, Judy 1.0.5-18.module+el8.4.0+9031+9abc7af9, galera 25.3.34-4.module+el8.4.0+15058+0c3d11c7, galera 26.4.14-1.module+el8.4.0+20291+fd32d29c, mariadb 10.3.32-3.module+el8.4.0+23808+e07e6ffa, mariadb 10.5.22-3.module+el8.4.0+23847+f2036569, +21 more
    fixed: vendor fix RHSA-2026:0333
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) Judy 1.0.5-18.module+el8+2765+cfa4f87b, Judy 1.0.5-18.module+el8.4.0+9031+9abc7af9, galera 25.3.35-1.module+el8.6.0+15949+4ba4ec26, galera 26.4.14-1.module+el8.6.0+20274+5db7ad9f, mariadb 10.3.35-2.module+el8.6.0+23817+0c0bfeb4, mariadb 10.5.22-2.module+el8.6.0+23818+e40eb7e6, +21 more Red Hat Enterprise Linux AppStream E4S (v.8.6) Judy 1.0.5-18.module+el8+2765+cfa4f87b, Judy 1.0.5-18.module+el8.4.0+9031+9abc7af9, galera 25.3.35-1.module+el8.6.0+15949+4ba4ec26, galera 26.4.14-1.module+el8.6.0+20274+5db7ad9f, mariadb 10.3.35-2.module+el8.6.0+23817+0c0bfeb4, mariadb 10.5.22-2.module+el8.6.0+23818+e40eb7e6, +21 more
    fixed: vendor fix RHSA-2026:0304
show 14 more
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) Judy 1.0.5-18.module+el8+2765+cfa4f87b, Judy 1.0.5-18.module+el8.4.0+9031+9abc7af9, galera 25.3.37-1.module+el8.8.0+19444+aac3c36b, galera 26.4.14-1.module+el8.8.0+20134+a92c7654, mariadb 10.3.39-4.module+el8.8.0+23827+92695e7c, mariadb 10.5.22-2.module+el8.8.0+23802+124431be, +21 more
    fixed: vendor fix RHSA-2026:0296
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) mariadb 10.5.22-1.el9_0.1, mariadb-pam 10.5.22-1.el9_0.1, mariadb-backup 10.5.22-1.el9_0.1, mariadb-common 10.5.22-1.el9_0.1, mariadb-errmsg 10.5.22-1.el9_0.1, mariadb-server 10.5.22-1.el9_0.1, +5 more
    fixed: vendor fix RHSA-2026:0351
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) mariadb 10.5.22-2.el9_2, mariadb-pam 10.5.22-2.el9_2, mariadb-backup 10.5.22-2.el9_2, mariadb-common 10.5.22-2.el9_2, mariadb-errmsg 10.5.22-2.el9_2, mariadb-server 10.5.22-2.el9_2, +5 more
    fixed: vendor fix RHSA-2026:0112
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) mariadb 10.11.15-1.el10_0, mariadb-pam 10.11.15-1.el10_0, mariadb-test 10.11.15-1.el10_0, mariadb10.11 10.11.15-1.el10_0, mariadb-backup 10.11.15-1.el10_0, mariadb-common 10.11.15-1.el10_0, +8 more
    fixed: vendor fix RHSA-2026:0376
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) mariadb 10.5.22-2.el9_4, mariadb-pam 10.5.22-2.el9_4, mariadb-backup 10.5.22-2.el9_4, mariadb-common 10.5.22-2.el9_4, mariadb-errmsg 10.5.22-2.el9_4, mariadb-server 10.5.22-2.el9_4, +18 more
    fixed: vendor fix RHSA-2026:0335
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) mariadb 10.5.29-3.el9_6, mariadb-pam 10.5.29-3.el9_6, mariadb-backup 10.5.29-3.el9_6, mariadb-common 10.5.29-3.el9_6, mariadb-errmsg 10.5.29-3.el9_6, mariadb-server 10.5.29-3.el9_6, +18 more
    fixed: vendor fix RHSA-2026:0334
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) Judy 1.0.5-18.module+el8+2765+cfa4f87b, Judy 1.0.5-18.module+el8.4.0+9031+9abc7af9, galera 25.3.34-4.module+el8.4.0+15058+0c3d11c7, galera 26.4.14-1.module+el8.4.0+20291+fd32d29c, mariadb 10.3.32-3.module+el8.4.0+23808+e07e6ffa, mariadb 10.5.22-3.module+el8.4.0+23847+f2036569, +21 more
    fixed: vendor fix RHSA-2026:0333
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) Judy 1.0.5-18.module+el8+2765+cfa4f87b, Judy 1.0.5-18.module+el8.4.0+9031+9abc7af9, galera 25.3.35-1.module+el8.6.0+15949+4ba4ec26, galera 26.4.14-1.module+el8.6.0+20274+5db7ad9f, mariadb 10.3.35-2.module+el8.6.0+23817+0c0bfeb4, mariadb 10.5.22-2.module+el8.6.0+23818+e40eb7e6, +21 more
    fixed: vendor fix RHSA-2026:0304
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) Judy 1.0.5-18.module+el8+2765+cfa4f87b, Judy 1.0.5-18.module+el8.4.0+9031+9abc7af9, galera 25.3.37-1.module+el8.8.0+19444+aac3c36b, galera 26.4.14-1.module+el8.8.0+20134+a92c7654, mariadb 10.3.39-4.module+el8.8.0+23827+92695e7c, mariadb 10.5.22-2.module+el8.8.0+23802+124431be, +21 more
    fixed: vendor fix RHSA-2026:0296
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) mariadb-test 10.5.29-3.el9_7
    fixed: vendor fix RHSA-2026:0137
  • Red Hat Enterprise Linux CRB (v. 8) asio 1.10.8-7.module+el8.9.0+19449+ad5852d3, Judy 1.0.5-18.module+el8.9.0+19449+ad5852d3, galera 25.3.37-1.module+el8.9.0+19449+ad5852d3, mariadb 10.3.39-2.module+el8.10.0+23756+5eac0e54, mariadb-test 10.3.39-2.module+el8.10.0+23756+5eac0e54, mariadb-backup 10.3.39-2.module+el8.10.0+23756+5eac0e54, +8 more
    fixed: vendor fix RHSA-2026:0698
  • Red Hat Enterprise Linux Server (v. 7 ELS) mariadb 5.5.68-1.el7_9.1, mariadb-libs 5.5.68-1.el7_9.1, mariadb-test 5.5.68-1.el7_9.1, mariadb-bench 5.5.68-1.el7_9.1, mariadb-server 5.5.68-1.el7_9.1 Red Hat Enterprise Linux Server Optional (v. 7 ELS) mariadb-embedded 5.5.68-1.el7_9.1
    fixed: vendor fix RHSA-2026:0367
  • Red Hat Hardened Images mariadb11.8 11.8.6-2.2.hum1, mariadb10.11 10.11.16-2.2.hum1, mariadb10.11-pam 10.11.16-2.2.hum1, mariadb10.11-test 10.11.16-2.2.hum1, mariadb10.11-backup 10.11.16-2.2.hum1, mariadb10.11-common 10.11.16-2.2.hum1, +13 more
    fixed: vendor fix RHSA-2026:8812
  • Red Hat Enterprise Linux 10 mariadb11.8 Red Hat Hardened Images mariadb 11.8.6-2.2.hum1, mariadb-pam 11.8.6-2.2.hum1, mariadb-test 11.8.6-2.2.hum1, mariadb-backup 11.8.6-2.2.hum1, mariadb-common 11.8.6-2.2.hum1, mariadb-errmsg 11.8.6-2.2.hum1, +12 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
10mo ago

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.0 7.0 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • MariaDB MariaDB

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.