A security flaw has been identified in MariaDB, a popular open-source database platform used by many websites. The issue only impacts specific MariaDB versions running on Windows servers that have the CONNECT engine installed and REST support enabled: versions 10.6.1 to just before 10.6.26, 10.11.1 to just before 10.11.17, 11.4.1 to just before 11.4.11, 11.8.1 to just before 11.8.7, and version 12.3.1.
The flaw occurs because the software fails to properly sanitize the HTTP table attribute before passing it to a system command. This creates a path for unauthorized users to run arbitrary shell commands directly on the server hosting your site, which could allow them to access, modify, or delete your site's data, or take other harmful actions on the server.
This vulnerability has been patched in updated MariaDB versions: 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-44170
