MariaDB versions prior to 10.5.29-3.oe2203sp4 and certain other branches created a mysql service account with the database data directory as its home. A database user with FILE privilege could write startup dot-files like .bash_profile into this home directory, which could execute when an administrator logged into the mysql account. Debian packages are not affected due to using a non-existent home directory. This issue is fixed in multiple MariaDB versions including 10.5.29-3.oe2203sp4.