High severity · published Dec 23, 2025
CVE-2025-13699
MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability
7.0
CVSS
0.5%
EPSS
No
On KEV
Description
MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000.
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
MariaDB · MariaDB
11.8.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13699
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13699
jira.mariadb.org
https://jira.mariadb.org/browse/MDEV-37483
www.zerodayinitiative.com
https://www.zerodayinitiative.com/advisories/ZDI-25-1025/
More from MariaDB
9.9
CVE-2026-85748
MariaDB: Use-after-free with a large number of SYS_REFCURSOR's
9.9
CVE-2026-85746
MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
9.9
CVE-2026-92262
MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.
9.9
CVE-2026-32710
Heap-based Buffer Overflow in MariaDB
9.8
CVE-2026-44170
MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL
