Live › vulnerability › CVE-2026-119210
MariaDB Connector/J, the Java driver for MariaDB and MySQL, can be tricked by a malicious or compromised database server into requesting a local file from the client machine. With allowLocalInfile enabled, the driver then streams any readable client-host file named in the crafted identifiers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 21:26 UTC. All times on this page are UTC.
Java applications that connect to MariaDB or MySQL with Connector/J versions from 3.0.0 up to but not including the fixed releases. Exposure needs allowLocalInfile enabled and a database server that is malicious, compromised, or reachable by a machine-in-the-middle attacker. Applications using the default configuration with allowLocalInfile off are not exposed.
No product ranges from the sources yet.
pom.xml or build.gradle) and see whether it falls in an affected range.allowLocalInfile=true in JDBC URLs.3.3.7, 3.4.5, or , matching your current release line.3.5.11Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName() check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string literals, or comments instead of requiring a real statement. A malicious or compromised server, or a machine-in-the-middle attacker, could return crafted database or table identifiers that the connector reused in metadata or updatable-result queries, then answer with a LOCAL INFILE request for a client file. With allowLocalInfile enabled, this caused the connector to stream any readable client-host file named by the crafted text, including through DatabaseMetaData.getImportedKeys(), DatabaseMetaData.getExportedKeys(), or ResultSet.updateRow() paths. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
This page as .md · .json · in your agent: get_signal("CVE-2026-119210")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.