🎯 New Report #3849051: #mysql50# legacy alias / internal table collisions
🔺Severity: null
👽 Reporter: vortfu
⭐️ Reputation: 519
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-07
⏰ Disclosed: 2026-10-07 19:48:18
📝 Summary: A vulnerability was discovered in MariaDB related to the legacy #mysql50# table name prefix feature. The issue involved improper encoding of table names prefixed with #mysql50#, which allowed attackers to create tables that collided with internal reserved filenames used by the database system and storage engines. This encoding bypass enabled unauthorized access to hidden tables, manipulation of partition metadata, and circumvention of access control lists. The vulnerability could be exploited to achieve remote code execution through multiple attack vectors including partition physical-table record overflows, vector index helper table manipulation, and merge table ACL bypasses.
📂 Report JSON File: 3849051
@hackeronereports