CVE-2025-13699 MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability
Remote attackers can execute arbitrary code via directory traversal in the mariadb-dump utility due to improper path validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-13699?
CVE-2025-13699 is a high-severity path traversal vulnerability in MariaDB, published on 23 Dec 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000.
Weakness: CWE-22
Which versions are affected by CVE-2025-13699?
Linux distribution packages (40)
Judy AlmaLinux:8 | All versions | 1.0.5-18.module_el8.10.0+3794+c6a66d65 |
Judy AlmaLinux:8 | All versions | 1.0.5-18.module_el8.10.0+3947+ac422511 |
Judy AlmaLinux:8 | All versions | 1.0.5-18.module_el8.10.0+3955+6534edaf |
Judy AlmaLinux:8 | All versions | 1.0.5-18.module_el8.6.0+2867+72759d2f |
Judy AlmaLinux:8 | All versions | 1.0.5-18.module_el8.6.0+3138+72759d2f |
Judy AlmaLinux:8 | All versions | 1.0.5-18.module_el8.8.0+3620+5d452900 |
galera AlmaLinux:8 | All versions | 25.3.37-1.module_el8.8.0+3609+204d4ab0 |
galera AlmaLinux:8 | All versions | 26.4.20-1.module_el8.10.0+3955+6534edaf |
galera AlmaLinux:8 | All versions | 26.4.22-1.module_el8.10.0+4059+10818090 |
mariadb AlmaLinux:8 | All versions | 3:10.11.10-2.module_el8.10.0+4091+e8693c5e |
mariadb AlmaLinux:8 | All versions | 3:10.3.39-2.module_el8.10.0+4093+5130acef |
mariadb AlmaLinux:8 | All versions | 3:10.5.29-3.module_el8.10.0+4094+f90dcfa6 |
mariadb-backup AlmaLinux:8 | All versions | 3:10.11.10-2.module_el8.10.0+4091+e8693c5e |
mariadb-backup AlmaLinux:8 | All versions | 3:10.3.39-2.module_el8.10.0+4093+5130acef |
mariadb-backup AlmaLinux:8 | All versions | 3:10.5.29-3.module_el8.10.0+4094+f90dcfa6 |
mariadb-common AlmaLinux:8 | All versions | 3:10.11.10-2.module_el8.10.0+4091+e8693c5e |
mariadb-common AlmaLinux:8 | All versions | 3:10.3.39-2.module_el8.10.0+4093+5130acef |
mariadb-common AlmaLinux:8 | All versions | 3:10.5.29-3.module_el8.10.0+4094+f90dcfa6 |
mariadb-devel AlmaLinux:8 | All versions | 3:10.11.10-2.module_el8.10.0+4091+e8693c5e |
mariadb-devel AlmaLinux:8 | All versions | 3:10.3.39-2.module_el8.10.0+4093+5130acef |
mariadb-devel AlmaLinux:8 | All versions | 3:10.5.29-3.module_el8.10.0+4094+f90dcfa6 |
mariadb-embedded AlmaLinux:8 | All versions | 3:10.11.10-2.module_el8.10.0+4091+e8693c5e |
mariadb-embedded AlmaLinux:8 | All versions | 3:10.3.39-2.module_el8.10.0+4093+5130acef |
mariadb-embedded AlmaLinux:8 | All versions | 3:10.5.29-3.module_el8.10.0+4094+f90dcfa6 |
mariadb-embedded-devel AlmaLinux:8 | All versions | 3:10.11.10-2.module_el8.10.0+4091+e8693c5e |
mariadb-embedded-devel AlmaLinux:8 | All versions | 3:10.3.39-2.module_el8.10.0+4093+5130acef |
mariadb-embedded-devel AlmaLinux:8 | All versions | 3:10.5.29-3.module_el8.10.0+4094+f90dcfa6 |
mariadb-errmsg AlmaLinux:8 | All versions | 3:10.11.10-2.module_el8.10.0+4091+e8693c5e |
mariadb-errmsg AlmaLinux:8 | All versions | 3:10.3.39-2.module_el8.10.0+4093+5130acef |
mariadb-errmsg AlmaLinux:8 | All versions | 3:10.5.29-3.module_el8.10.0+4094+f90dcfa6 |
mariadb-gssapi-server AlmaLinux:8 | All versions | 3:10.11.10-2.module_el8.10.0+4091+e8693c5e |
mariadb-gssapi-server AlmaLinux:8 | All versions | 3:10.3.39-2.module_el8.10.0+4093+5130acef |
mariadb-gssapi-server AlmaLinux:8 | All versions | 3:10.5.29-3.module_el8.10.0+4094+f90dcfa6 |
mariadb-oqgraph-engine AlmaLinux:8 | All versions | 3:10.11.10-2.module_el8.10.0+4091+e8693c5e |
mariadb-oqgraph-engine AlmaLinux:8 | All versions | 3:10.3.39-2.module_el8.10.0+4093+5130acef |
mariadb-oqgraph-engine AlmaLinux:8 | All versions | 3:10.5.29-3.module_el8.10.0+4094+f90dcfa6 |
mariadb-pam AlmaLinux:8 | All versions | 3:10.11.10-2.module_el8.10.0+4091+e8693c5e |
mariadb-pam AlmaLinux:8 | All versions | 3:10.5.29-3.module_el8.10.0+4094+f90dcfa6 |
mariadb-server AlmaLinux:8 | All versions | 3:10.11.10-2.module_el8.10.0+4091+e8693c5e |
mariadb-server AlmaLinux:8 | All versions | 3:10.3.39-2.module_el8.10.0+4093+5130acef |
How do I fix CVE-2025-13699?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-13699 being exploited?
There is no known exploitation of CVE-2025-13699 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:0137, ALSA-2026:0225, ALSA-2026:0232, ALSA-2026:0233, AZL-73186, AZL-73190 and 43 more.