In MariaDB 10.6 through 13.0, table names with the #mysql50# prefix bypass file name encoding, allowing low-privileged users to trigger crashes, data exfiltration, or remote code execution under CVE-2026-92262 (CVSS 9.9). With no workaround available, upgrading to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2 or later is required.
