[MDEV-39408] mbstream insufficient path validation - Jira

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Critical
Resolution: Fixed
Affects Version/s: 10.6(EOL), 10.11, 11.4, 11.8, 12.3
Fix Version/s: 10.6.26, 10.11.17, 11.4.11, 11.8.7, 12.3.2
Component/s: mariabackup
Labels:
None

Bug Category:
Can result in unexpected behaviour

Description

specially crafted mbstream file (attached) can make mbstream to create files outside of the target dir.

Reported by Riley Scott Jacob.

Attachments

Attachments

- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List
- Download All

mdev-39408.mb
0.3 kB
2026-04-22 13:12

Issue Links

links to

GHSA-9pjh-5hhw-65v9

Activity

People

Assignee:: Sergei Golubchik

Reporter:: Sergei Golubchik

Assigned for Implementation:: Sergei Golubchik

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 2026-04-22 13:10

Updated:: 2026-10-10 20:45

Resolved:: 2026-04-27 07:44

Time Tracking

Estimated:

Not Specified

Remaining:

0d

Logged:

4.75h

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.