CVE-2006-4226

Severity: low (CVSS 3.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-08-18 · updated 2026-06-16

Description

MySQL before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive filesystems, allows remote authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions.

Affected products

Mysql: 4.1.0, 4.1.2, 4.1.3, 4.1.8, 4.1.10, 4.1.12 (+17)
MySQL Server: 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5 (+66)

References

http://bugs.mysql.com/bug.php?id=17647
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-25.html
http://docs.info.apple.com/article.html?artnum=305214
http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html
http://lists.mysql.com/commits/5927
http://secunia.com/advisories/21506
http://secunia.com/advisories/21627
http://secunia.com/advisories/21762
http://secunia.com/advisories/22080
http://secunia.com/advisories/24479
http://secunia.com/advisories/24744
http://securitytracker.com/id?1016710

Get alerted when CVE-2006-4226 or the next vulnerability affects your stack