MariaDB server versions prior to 10.11.19-2.oe2403sp4 contain a vulnerability where the mysql service account's home directory is set to the database data directory. A database user with FILE privilege could write startup dot-files like .bash_profile into this directory, which could execute when an administrator logs into the mysql account. Debian packages are not affected due to different home directory settings. This issue is fixed in version 10.11.19-2.oe2403sp4 and later.