CVE-2026-92262

{
  "etk_id": "ETK-2026-1795",
  "cve_id": "CVE-2026-92262",
  "display_id": "CVE-2026-92262",
  "ghsa_id": "GHSA-65jj-h265-3m7h",
  "euvd_id": "EUVD-2026-102939",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Legacy table-name encoding bypass in MariaDB server",
  "summary": "MariaDB Server releases from 10.6.1 up to the branch-specific fixes mishandle a legacy table-name prefix when resolving filesystem names. An attacker with permission to create or use affected table names may access files by legacy names, potentially leading to crashes, data modification, data disclosure, or code execution.",
  "mitigation": "Upgrade unnamed to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2 or later.",
  "vendor": "MariaDB",
  "product": "Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "10.6.1-10.6.27",
        "10.11.1-10.11.18",
        "11.4.1-11.4.12",
        "11.8.1-11.8.8",
        "12.3.1-12.3.2",
        "13.0.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "10.6.28",
        "10.11.19",
        "11.4.13",
        "11.8.9",
        "12.3.3",
        "13.0.2"
      ],
      "package_name": null,
      "purl": null
    }
  ],
  "cwes": [
    706
  ],
  "cvss_score": 9.9,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": 0.0068,
  "epss_percentile": 0.5141,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.333080566666666,
  "t0_at": "2026-10-16T16:25:46.964000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-18T19:18:24+00:00",
      "days": 2.119873101851852,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T16:25:46.964000+00:00",
      "url": "https://github.com/SeanDishman/mariadb-cve-2026-92262"
    },
    "trigger_signal": {
      "at": "2026-10-16T16:25:46.964000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T16:25:46.964000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92262"
    }
  }
}