MariaDB's FILE Privilege Is a Filesystem Primitive: CVE-2026-107814 and CVE-2026-107818

Vulnerability overview

The Cyber Security Agency of Singapore published alert AL-2026-144 on 16 October 2026 describing five MariaDB Server vulnerabilities fixed by the project. Two of them share a cause that a patch note makes easy to skim past. CVE-2026-107814 and CVE-2026-107818 are both rated 8.4 under CVSS v3.1, and both turn an ordinary database grant into the ability to write files that the operating system later trusts.

The other three flaws in the same release are CVE-2026-107815 at 8.5, CVE-2026-107821 at 8.0 and CVE-2026-107823 at 7.2.…