CVE-2025-13699

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13699", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2025-11-25T21:39:52.281Z", "datePublished": "2025-12-23T21:40:56.956Z", "dateUpdated": "2025-12-24T16:10:43.525Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2025-12-23T21:40:56.956Z"}, "title": "MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability", "descriptions": [{"lang": "en", "value": "MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}], "affected": [{"vendor": "MariaDB", "product": "MariaDB", "versions": [{"version": "11.8.3", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1025/", "name": "ZDI-25-1025", "tags": ["x_research-advisory"]}, {"url": "https://jira.mariadb.org/browse/MDEV-37483", "name": "vendor-provided URL", "tags": ["vendor-advisory"]}], "dateAssigned": "2025-11-25T21:39:52.300Z", "datePublic": "2025-11-27T15:53:22.915Z", "source": {"lang": "en", "value": "Litezeraw"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-24T16:10:37.452157Z", "id": "CVE-2025-13699", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-24T16:10:43.525Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13699", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-24T16:10:37.452157Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-24T16:10:40.202Z"}}], "cna": {"title": "MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability", "source": {"lang": "en", "value": "Litezeraw"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "MariaDB", "product": "MariaDB", "versions": [{"status": "affected", "version": "11.8.3"}], "defaultStatus": "unknown"}], "datePublic": "2025-11-27T15:53:22.915Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1025/", "name": "ZDI-25-1025", "tags": ["x_research-advisory"]}, {"url": "https://jira.mariadb.org/browse/MDEV-37483", "name": "vendor-provided URL", "tags": ["vendor-advisory"]}], "dateAssigned": "2025-11-25T21:39:52.300Z", "descriptions": [{"lang": "en", "value": "MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2025-12-23T21:40:56.956Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13699", "state": "PUBLISHED", "dateUpdated": "2025-12-24T16:10:43.525Z", "dateReserved": "2025-11-25T21:39:52.281Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2025-12-23T21:40:56.956Z", "assignerShortName": "zdi"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "MariaDB", "vendor": "MariaDB", "versions": [{"status": "affected", "version": "11.8.3"}]}], "source": "zdi-disclosures@trendmicro.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio y ejecuci\u00f3n remota de c\u00f3digo (RCE) en la utilidad mariadb-dump de MariaDB. Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en instalaciones afectadas de MariaDB. Se requiere interacci\u00f3n con la utilidad mariadb-dump para explotar esta vulnerabilidad, aunque los vectores de ataque pueden variar seg\u00fan la implementaci\u00f3n.\\n\\nEl defecto espec\u00edfico existe en el manejo de los nombres de vistas. El problema se debe a la falta de validaci\u00f3n adecuada de una ruta suministrada por el usuario antes de usarla en operaciones de archivo. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del usuario actual. Fue ZDI-CAN-27000."}], "id": "CVE-2025-13699", "lastModified": "2026-10-19T22:10:00.130", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13699", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-24T16:10:37.452157Z", "version": "2.0.3"}}]}, "published": "2025-12-23T22:15:44.800", "references": [{"source": "zdi-disclosures@trendmicro.com", "url": "https://jira.mariadb.org/browse/MDEV-37483"}, {"source": "zdi-disclosures@trendmicro.com", "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{"bugzilla": {"description": "mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation", "id": "2417693", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2417693"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in MariaDB. This vulnerability allows remote attackers to execute arbitrary code on affected installations via improper validation of a user-supplied path prior to using it in file operations in the mariadb-dump utility, requiring user interaction."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2025-13699", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "mariadb10.11", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "mariadb11.8", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "mariadb", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "mariadb:10.11/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "mariadb:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "mariadb:10.5/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "mariadb-devel:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "mariadb", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "mariadb:10.11/mariadb", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-11-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-13699\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-13699"], "statement": "This vulnerability in MariaDB's `mariadb-dump` utility allows for remote code execution due to improper validation of user-supplied paths. Exploitation requires user interaction, specifically with the `mariadb-dump` utility, and successful exploitation could lead to arbitrary code execution in the context of the current user.", "threat_severity": "Important"}

{"created": "2025-12-24T11:51:59.979210+00:00", "updated": "2025-12-24T11:51:59.979235+00:00", "vendors": ["mariadb", "mariadb$PRODUCT$mariadb"]}