Most recent entries from all

EUVD-2026-373314

fkie_cve-2026-61700

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sends a LOAD DATA LOCAL INFILE COM_QUERY, a rogue or man-in-the-middle server can echo the same filename and cause the connector to transmit that file despite the disabled option. The server cannot redirect the request to an arbitrary path and can receive only the exact file already selected by the application, so exploitation requires an application that actively loads sensitive data over an untrusted connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.

GHSA-wxmm-q36w-r9xj — MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

Affected: Maven: org.mariadb.jdbc:mariadb-java-client

## Summary

MariaDB Connector/J does not enforce `allowLocalInfile=false` when processing server-initiated LOCAL INFILE requests (protocol packet type `0xfb`). However, exploitation is constrained: the server can only request the exact filename the client already included in its `LOAD DATA LOCAL INFILE` query, it cannot redirect to arbitrary paths.

## Details

When a client executes `LOAD DATA LOCAL INFILE '/path/to/file'`, the connector sends the filename to the server as part of the COM_QUERY. A rogue or MitM server responds with a `0xfb` packet echoing that same filename. The connector, without checking `allowLocalInfile`, transmits the file content.

The bypass is therefore limited to the file the application itself intended to load. The attacker cannot escalate to other files (e.g. `/etc/passwd`) unless the application's own query targets them.

The real-world risk is: - An application that uses `LOAD DATA LOCAL INFILE` on potentially sensitive files (credentials, exports, configs) and connects over an untrusted network. - `allowLocalInfile=false` is supposed to disable this entire mechanism as a defense-in-depth measure, but the flag is ignored.

## Impact

The security guarantee of `allowLocalInfile=false` is not upheld, but practical exploitation requires both a MitM/rogue server and an application that actively uses LOCAL INFILE on sensitive data.

## Credit

Reported by tharavel

UBUNTU-CVE-2026-61700

Affected: Ubuntu:18.04:LTS: mariadb-connector-java, Ubuntu:20.04:LTS: mariadb-connector-java, Ubuntu:22.04:LTS: mariadb-connector-java, Ubuntu:24.04:LTS: mariadb-connector-java, Ubuntu:26.04:LTS: mariadb-connector-java