CVE-2026-92262
Critical · 9.9CVSS
9.9
EPSS
0.7%
Published
Oct 16, 2026
CISA due date
—
The record
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-114663 Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default… CWE-706
- CVE-2026-14288 GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before… CWE-706
- CVE-2026-107822 MariaDB server is a community developed fork of MySQL server. CWE-706
- CVE-2026-92951 vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external… CWE-706
- CVE-2026-87618 Incorrect reference resolution in Storage in Google Chrome on on Windows prior to… CWE-706
- CVE-2026-87613 Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36… CWE-706
- CVE-2026-87562 Incorrect reference resolution in Accessibility in Google Chrome on on Mac prior to… CWE-706
- CVE-2026-87547 Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36… CWE-706