{"id":"CVE-2026-119210","kind":"vulnerability","aliases":["CVE-2026-119210"],"related":[],"title":"MariaDB Connector/J: crafted identifiers let a server read client files","description":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName() check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string literals, or comments instead of requiring a real statement. A malicious or compromised server, or a machine-in-the-middle attacker, could return crafted database or table identifiers that the connector reused in metadata or updatable-result queries, then answer with a LOCAL INFILE request for a client file. With allowLocalInfile enabled, this caused the connector to stream any readable client-host file named by the crafted text, including through DatabaseMetaData.getImportedKeys(), DatabaseMetaData.getExportedKeys(), or ResultSet.updateRow() paths. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.","summary":"MariaDB Connector/J, the Java driver for MariaDB and MySQL, can be tricked by a malicious or compromised database server into requesting a local file from the client machine. With allowLocalInfile enabled, the driver then streams any readable client-host file named in the crafted identifiers.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","jdbc","mariadb","mysql","package"],"not_affected_if":["default-config","local-infile-disabled","trusted-database-server"],"how_to_check":"- Check the connector version in the project build file (for example the mariadb-java-client entry in `pom.xml` or `build.gradle`) and see whether it falls in an affected range.\n- Search the application configuration for `allowLocalInfile=true` in JDBC URLs.","fix":"- Upgrade to `3.3.7`, `3.4.5`, or `3.5.11`, matching your current release line.","status":"open","published_at":"2026-10-29T21:17:20+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","triaged_at":"2026-10-29T21:28:51+00:00","updated_at":"2026-10-29T21:28:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T21:28:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `3.3.7`, `3.4.5`, or `3.5.11`, matching your current release line.","reach":"network","title":"MariaDB Connector/J: crafted identifiers let a server read client files","impact":"medium","summary":"MariaDB Connector/J, the Java driver for MariaDB and MySQL, can be tricked by a malicious or compromised database server into requesting a local file from the client machine. With allowLocalInfile enabled, the driver then streams any readable client-host file named in the crafted identifiers.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","mariadb","mysql","jdbc"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"client files readable by the application process are streamed to the server","analyst_note":"","how_to_check":"- Check the connector version in the project build file (for example the mariadb-java-client entry in `pom.xml` or `build.gradle`) and see whether it falls in an affected range.\n- Search the application configuration for `allowLocalInfile=true` in JDBC URLs.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","local-infile-disabled","trusted-database-server"],"who_is_affected":"Java applications that connect to MariaDB or MySQL with Connector/J versions from 3.0.0 up to but not including the fixed releases. Exposure needs allowLocalInfile enabled and a database server that is malicious, compromised, or reachable by a machine-in-the-middle attacker. Applications using the default configuration with allowLocalInfile off are not exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000735,"input_tokens":4362,"output_tokens":597,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119210':13A,16A '-2026':12A,15A '3.0.0':84C '3.3.7':86C,193C '3.4.5':87C,194C '3.5.11':89C,196C 'allowlocalinfil':51B,161C 'answer':150C 'applic':74C 'attack':130C 'caus':164C 'check':92C 'client':9A,48B,60B,158C,172C 'client-host':59B,171C 'clientmessage.validatelocalfilename':91C 'comment':111C 'compromis':38B,121C 'connect':73C 'connector':140C,166C 'connector/j':2A,23B,69C 'could':98C,131C 'craft':3A,66B,133C,178C 'cve':11A,14A 'data':101C 'databas':39B,82C,134C 'databasemetadata.getexportedkeys':183C 'databasemetadata.getimportedkeys':182C 'develop':75C 'driver':26B,54B 'enabl':52B,162C 'express':96C 'file':10A,45B,62B,159C,174C 'fix':190C 'host':61B,173C 'identifi':4A,67B,107C,137C 'includ':180C 'infil':103C,154C 'insid':105C 'instead':112C 'issu':188C 'java':17B,25B,77C 'jdbc':18B 'let':5A 'liter':109C 'load':100C 'local':44B,102C,153C 'machin':49B,126C 'machine-in-the-middl':125C 'malici':36B,119C 'mariadb':1A,19B,22B,28B,68C,79C 'match':99C 'metadata':143C 'middl':129C 'mysql':20B,30B,81C 'name':63B,175C 'packag':21B 'path':186C 'queri':148C 'quot':106C 'read':8A 'readabl':58B,170C 'real':116C 'regular':95C 'request':42B,155C 'requir':114C 'result':147C 'resultset.updaterow':185C 'return':132C 'reus':141C 'server':7A,40B,122C 'statement':117C 'stream':56B,168C 'string':108C 'tabl':136C 'text':104C,179C 'trick':33B 'updat':146C 'updatable-result':145C 'use':71C,93C 'version':192C","nicknames":[],"mitigations":[],"who_affected":"Java applications that connect to MariaDB or MySQL with Connector/J versions from 3.0.0 up to but not including the fixed releases. Exposure needs allowLocalInfile enabled and a database server that is malicious, compromised, or reachable by a machine-in-the-middle attacker. Applications using the default configuration with allowLocalInfile off are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T21:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119210","severity":null,"published_at":"2026-10-29T21:17:20+00:00","modified_at":"2026-10-29T21:17:20+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","fetched_at":"2026-10-29T21:26:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}