[MDEV-39565] missing filename check in mariadb-backup --decompress - Jira

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 10.6, 10.11, 11.4, 11.8, 12.3
Fix Version/s: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.2
Component/s: mariabackup
Labels:
None

Bug Category:
Can result in unexpected behaviour
Sprint:
Q2/2026 Server Development

Description

mariadb-backup did not verify that the *.qp files were valid table tables before invoking qpress.
This allowed filenames with embedded shell metacharacters that normally can never be present within a backup.

Reported by Sean Nejad.

Attachments

Activity

People

Assignee:: Sergei Golubchik

Reporter:: Sergei Golubchik

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 2026-05-11 20:02

Updated:: 2026-05-20 21:22

Resolved:: 2026-05-20 21:22

Time Tracking

Estimated:

Remaining:

Logged:

0.25d

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.