{"id":"CVE-2026-85985","summary":"MariaDB: Unauthorized file access via CONNECT engine UDFs","details":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","aliases":["BIT-mariadb-2026-85985","BIT-mariadb-min-2026-85985","BIT-mysql-client-2026-85985","GHSA-2245-9hm3-wxf6"],"modified":"2026-10-22T16:40:11.990626242Z","published":"2026-10-16T16:21:14.677Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85985.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85985.json"},{"type":"FIX","url":"https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"},{"type":"ADVISORY","url":"https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6"},{"type":"WEB","url":"https://jira.mariadb.org/browse/MDEV-40323"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85985"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mariadb/server","events":[{"introduced":"00a8357bd30fdfca23720448a3f638290b6d35b7"},{"fixed":"210ab6edf47fa73f3b77e974ed2e9357ccdd051c"},{"introduced":"2437674291f31c91869a74eb6ebd9f03dc52bd43"},{"fixed":"93e051860a9c7e87ee8cee6ed38b640d491f7170"},{"introduced":"fa69b085b10f19a3a8b6e7adab27c104924333ae"},{"fixed":"170b1d70737be6f134448f51713cdc1ae215b420"},{"introduced":"1c4aed7c680c0402d6e97e097f03815c0e9bf4c5"},{"fixed":"bf9193a939f515e95dd8def1a5468088c91cede6"},{"introduced":"21a0714a118614982d20bfa504763d7247800091"},{"fixed":"83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e"},{"introduced":"7f923870722c5d382e16d56af526d1ee4e03f987"},{"fixed":"620a4b5624222048fece7fe1789978ae0675cae2"},{"fixed":"4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"10.6.1"},{"fixed":"10.6.28"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"introduced":"10.11.1"},{"fixed":"10.11.19"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"introduced":"11.4.1"},{"fixed":"11.4.13"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"strategy":"StringRangeExpression","range":[{"introduced":"11.8.1"},{"fixed":"11.8.9"}],"source":"AFFECTED_FIELD"},{"strategy":"StringRangeExpression","range":[{"introduced":"12.3.1"},{"fixed":"12.3.3"}],"source":"AFFECTED_FIELD"},{"strategy":"StringRangeExpression","range":[{"introduced":"13.0.1"},{"fixed":"13.0.2"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"mariadb-10.11.19","range":[{"fixed":"93e051860a9c7e87ee8cee6ed38b640d491f7170"}]},{"original_tag":"mariadb-10.6.28","range":[{"fixed":"210ab6edf47fa73f3b77e974ed2e9357ccdd051c"}],"source":"REFERENCES_TAG"},{"range":[{"fixed":"170b1d70737be6f134448f51713cdc1ae215b420"}],"source":"REFERENCES_TAG","original_tag":"mariadb-11.4.13"},{"range":[{"fixed":"bf9193a939f515e95dd8def1a5468088c91cede6"}],"source":"REFERENCES_TAG","original_tag":"mariadb-11.8.9"},{"original_tag":"mariadb-12.3.3","range":[{"fixed":"83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e"}],"source":"REFERENCES_TAG"},{"source":"REFERENCES_TAG","original_tag":"mariadb-13.0.2","range":[{"fixed":"620a4b5624222048fece7fe1789978ae0675cae2"}]}]}}],"versions":["mariadb-13.0.1","mariadb-10.6.27","mariadb-11.8.7b","mariadb-11.4.11b","mariadb-10.6.26","mariadb-11.8.7","mariadb-11.4.11","mariadb-12.3.1","mariadb-11.8.6","mariadb-11.4.10","mariadb-10.6.25","mariadb-11.8.4","mariadb-11.4.9","mariadb-10.6.24","mariadb-11.8.3","mariadb-10.6.23","mariadb-11.4.8","mariadb-11.8.2","mariadb-10.6.20","mariadb-11.4.7","mariadb-10.6.5","mariadb-11.4.6","mariadb-10.6.22","mariadb-11.8.1","mariadb-11.4.5","mariadb-10.6.21","mariadb-11.4.4","mariadb-10.6.18","mariadb-11.4.3","mariadb-10.6.19","mariadb-10.6.17","mariadb-11.4.2","mariadb-11.4.1","mariadb-10.6.16","mariadb-10.6.12","mariadb-10.6.14","mariadb-10.6.13","mariadb-10.6.11","mariadb-10.6.8","mariadb-10.6.9","mariadb-10.6.10","mariadb-10.6.6","mariadb-10.6.4","mariadb-10.6.3","mariadb-10.6.2","mariadb-10.6.1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-85985.json","vanir_signatures":[{"source":"https://github.com/mariadb/server/commit/83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e","target":{"file":"sql/log_event_server.cc","function":"Rows_log_event_fragmenter::fragment"},"deprecated":false,"digest":{"length":1715,"function_hash":"339712868486696881928202886484344029960"},"id":"CVE-2026-85985-1cd3e8db","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","target":{"file":"storage/connect/bsonudf.cpp","function":"bfile_make"},"deprecated":false,"digest":{"function_hash":"51538197006448953915320670849158504811","length":1872},"id":"CVE-2026-85985-339ade49","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-85985-4c3f0cde","signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","target":{"function":"bson_file","file":"storage/connect/bsonudf.cpp"},"deprecated":false,"digest":{"function_hash":"174666140590871606901473999763629558781","length":1498}},{"signature_version":"v1","source":"https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","target":{"function":"bbin_file","file":"storage/connect/bsonudf.cpp"},"deprecated":false,"digest":{"function_hash":"171216773621675811000547289823354805620","length":1207},"id":"CVE-2026-85985-4f031624","signature_type":"Function"},{"source":"https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","target":{"function":"jbin_file","file":"storage/connect/jsonudf.cpp"},"deprecated":false,"digest":{"length":1502,"function_hash":"127916986096898777617617736281859907014"},"id":"CVE-2026-85985-500d8fb6","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["265577632303887446289749120585557906012","90338461107598051749602183626527029076","135974257990159682542061181314070611477","59440921527566409168742990730026725636","871135494022066138858656571240698570","247293449498909397416026347351022219912","179396894775406735805665784479451940140","269443033021460921618747189093528286356","259691733175197008076763079871985256069","102338916828131457031608538914692707050","65381815336936246662830619643818353906","7100122396357284882133944108516856108","161393146120866756988306743699529625075"],"threshold":0.9},"id":"CVE-2026-85985-6d62851c","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb/server/commit/bf9193a939f515e95dd8def1a5468088c91cede6","target":{"file":"sql/item_vectorfunc.cc"}},{"target":{"file":"storage/connect/jsonudf.cpp","function":"json_file"},"deprecated":false,"digest":{"function_hash":"16792576655940462211639639962295085845","length":1495},"id":"CVE-2026-85985-77108977","signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe"},{"id":"CVE-2026-85985-912b43d1","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","target":{"file":"storage/connect/jsonudf.cpp"},"deprecated":false,"digest":{"line_hashes":["71765076455992845495603733103049780326","132468216307321099313474528141472164219","335104987168281452340257267070229799939","120856499846470636191643553421775300179","266852371692492258927372331806428738665","53555819227876951841873484659785190308","254998287201458333169381003665812377865","182581397748951836543531983394635579463","41083194844292017487014649926821159026","135591222975876619629644299378804531663","259433981832853299446593849105920851007","298218725377229319765890297238519131402","340056685524719056880338168855694856743","122339160352136500079256377464086248635","238024095887820003104130944620284587419","7830341983059510323793940240927348311","162912216835241415915754248202873951845","150361554933327464172574693705812571981","119916133982168928837148136908469466330","47640077213070997469095494059971947874","25712118322514378612707765649994426002","101449567833529954249637585070994316710","17897826500101088564491970597224714924"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","target":{"file":"storage/connect/jsonudf.cpp","function":"jfile_make"},"deprecated":false,"digest":{"function_hash":"244324594461433554125325936895563264854","length":1796},"id":"CVE-2026-85985-9286bb9f","signature_type":"Function"},{"target":{"function":"sp_revoke_privileges","file":"sql/sql_acl.cc"},"deprecated":false,"digest":{"function_hash":"19396654230727680862231874232577326830","length":1414},"id":"CVE-2026-85985-96fb114a","signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb/server/commit/210ab6edf47fa73f3b77e974ed2e9357ccdd051c"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb/server/commit/bf9193a939f515e95dd8def1a5468088c91cede6","target":{"file":"sql/item_vectorfunc.cc","function":"Item_func_vec_fromtext::fix_length_and_dec"},"deprecated":false,"digest":{"function_hash":"73617688475456381632237133958511949829","length":361},"id":"CVE-2026-85985-c0933a1f"},{"id":"CVE-2026-85985-c92ba8fe","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","target":{"file":"storage/connect/bsonudf.cpp"},"deprecated":false,"digest":{"line_hashes":["138670767569041361813718827546500861828","327352541066467771703787476014134557589","53052602935476390831583314750681766722","226497441160131621809579909316313981354","266852371692492258927372331806428738665","53555819227876951841873484659785190308","254998287201458333169381003665812377865","49746933461266227605020761995586309179","406035043658892995448339968673257055","53976655320527440774298789905523879059","325875844305542448445907678193496496932","325874974574524942517095799311151223390","186883866576677539495002692268579220386","17897826500101088564491970597224714924"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","target":{"file":"storage/connect/jsonudf.cpp","function":"jbin_file_init"},"deprecated":false,"digest":{"function_hash":"78729389804100571106228155026799037698","length":1047},"id":"CVE-2026-85985-d81404d8","signature_type":"Function"},{"source":"https://github.com/mariadb/server/commit/83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e","target":{"file":"sql/log_event_server.cc"},"deprecated":false,"digest":{"line_hashes":["171922335289695664967320282302097012127","314879264303882873216162120692739820747","296657960952465744719770094395708912555","28908880241426286725700820784852115102"],"threshold":0.9},"id":"CVE-2026-85985-e432b228","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-85985-ebba965d","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb/server/commit/210ab6edf47fa73f3b77e974ed2e9357ccdd051c","target":{"file":"sql/sql_acl.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["183641122820527899892205997373469390336","12095135203163139841028791777804307677","261887274333923489567884393156281229573","19596961056601881646204718953590518429","25158190267319178375799434564910426458","79868031186840623159971036872671971261","200778640584501115234958299261030732588","131021480572983927965383857652169015703","259210579588990591926922975771411684670","308293174102341777206582901688760031968","89478837310948837990084826679872794784","338867660209294619394468737325384824268","65149555481557669088217935797404683315","105820217938288583399134742620391383975","267805393157920367530703819131918882708","38039493077906535068223160253483389044","155248208230518966475406644089911097304","209055380163172280650138201893193615240","272836316798595100180885698601052815062","139632117011298755459574139848637089730","112587756624072824044503235660869015796","209449771227581042596611529590064743564","56162312170597687179668831370098686864","315300952757613979287910862404135586893","124631588903503696531604192284802908081","198447588607325890124688444202645428954","277625244959498228703902376649148264741","330117756961362545716991630961872097576","261593920518145687707482140334066129492","310029719624151742354329969579957852433","127355466400457567574110878344968834572","234782324348854453769025645027188821308","4933798797732149183640097703596172566","78315220821823291688255278082772905562","283495978258419445643401192492072153310","289680889044596507883491876189615178669","77013134991366103256989980017263461542"]}}],"vanir_signatures_modified":"2026-10-22T16:40:11Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}]}