CVE-2025-13699CWE-22path-traversal

CVE-2025-13699

High · published December 24, 2025

CVSS v3.0
7.0
EPSS
1%
Percentile
43.3
In the wild
Unconfirmed
What it is

⚡ A sneaky gap in the mariadb-dump utility could let attackers run wild with your system! This vulnerability lets remote attackers execute arbitrary code on affected installations of MariaDB. 🔥 Think of the mariadb-dump utility like a delivery driver who takes requests without checking the addresses — if someone provides the wrong path, they could end up delivering sensitive files straight to the wrong hands! If exploited, an attacker could take control of your system, executing potentially devastating commands with the privileges of the current user. This means they could read, modify, or even wipe your precious data, leaving you with a major headache!

Put simply

Think of the mariadb-dump utility like a delivery driver who takes requests without checking the addresses — if someone provides the wrong path, they could end up delivering sensitive files straight to the wrong hands! This directory traversal vulnerability arises from the mariadb-dump utility failing to properly validate user-supplied paths before using them for file operations, allowing for arbitrary code execution.

What to do

If exploited, an attacker could take control of your system, executing potentially devastating commands with the privileges of the current user. This means they could read, modify, or even wipe your precious data, leaving you with a major headache! To protect yourself, ensure you update to the latest version of MariaDB that includes the fix for this vulnerability. Additionally, audit your configurations and restrict access to the mariadb-dump utility to trusted users only. 🛡️ You've got this! By taking these steps, you can safeguard your system and earn your security hero badge! 💪✨

The record
Technical detail
CVSS v3.0
7.0 · HIGH
Vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00520 · 43.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-12-24T03:15Z
References (2)
EPSS history
Timeline
  • 23 DEC 21:40Z
    MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability
    cvelistv5