CVE-2026-119210

Overview

MariaDB Connector/J is MariaDB's JDBC driver: a JDBC 4.2 compatible driver used to connect applications developed in Java to MariaDB and MySQL databases. It is published to Maven Central as org.mariadb.jdbc:mariadb-java-client, and Spring Boot 2.7.18 manages its 3.1.4 release.

An information exposure vulnerability (CVE-2026-119210) has been identified in the LOAD DATA LOCAL INFILE file check of MariaDB Connector/J, which allows a malicious or compromised database server, or a machine-in-the-middle attacker, to read any file on the client host that the Java process can read. The driver accepts the server's file request when the requested file name appears in text of the query it sent, even when that text sits inside a quoted identifier or a comment rather than in a real LOAD DATA LOCAL INFILE statement.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of MariaDB Connector/J.

Details

Module Info

• Product: MariaDB Connector/J
• Affected packages: org.mariadb.jdbc:mariadb-java-client
• Affected versions: >=3.0.0 <3.3.7, >=3.4.0 <3.4.5, >=3.5.0 <3.5.11
• GitHub repository: https://github.com/mariadb-corporation/mariadb-connector-j
• Published packages: https://central.sonatype.com/artifact/org.mariadb.jdbc/mariadb-java-client
• Package manager: Maven
• Fixed in:
  • OSS MariaDB Connector/J 3.3.7, 3.4.5, 3.5.11
  • NES for MariaDB Connector/J v3.1.8

Vulnerability Info

This Medium-severity vulnerability is found in the org.mariadb.jdbc:mariadb-java-client package in multiple versions of MariaDB Connector/J. When the server answers a command with a LOCAL INFILE request (a 0xFB packet), ClientMessage reads the requested file name, asks the command's validateLocalFileName() whether the file corresponds to a LOAD DATA LOCAL INFILE in the SQL it sent, and if so opens the file with new FileInputStream(fileName) and streams its content to the server. The allowLocalInfile option that enables this path is on by default.

The check does not parse the SQL. It runs a regular expression over the raw command text, as in the 3.1.4 release:

static boolean validateLocalFileName(
    String sql, Parameters parameters, String fileName, Context context) {
  Pattern pattern =
      Pattern.compile(
          "^(\\s*\\/\\*([^\\*]|\\*[^\\/])*\\*\\/)*\\s*LOAD\\s+(DATA|XML)\\s+((LOW_PRIORITY|CONCURRENT)\\s+)?LOCAL\\s+INFILE\\s+'"
              + fileName
              + "'",
          Pattern.CASE_INSENSITIVE);
  if (pattern.matcher(sql).find()) {
    return true;
  }
  ...
}

Because the pattern only looks for matching text, it does not distinguish a real statement from the same words inside a string literal, a quoted identifier or a comment. In this form the leading block-comment sub-pattern ([^\*]|\*[^\/])* can consume a **/ sequence and keep matching past the real end of the comment, so a query such as /** hint **/ SELECT * FROM */ LOAD DATA LOCAL INFILE '/etc/passwd' satisfies the check for /etc/passwd. In this form only block comments may come before the matched text, so quoted text later in a query passes the check only when the query opens with such a comment; a query that starts with a statement keyword, such as SHOW CREATE TABLE, does not pass it. In later 3.3.x, 3.4.x and 3.5.x releases the pattern's prefix accepts any character, so the check passes whenever the text appears anywhere in the query. In those releases, several driver paths put identifiers returned by the server straight back into their next query, such as DatabaseMetaData.getImportedKeys(), DatabaseMetaData.getExportedKeys() and the UPDATE built by ResultSet.updateRow(), and applications can do the same with identifiers they read from the server. A server that returns an identifier containing LOAD DATA LOCAL INFILE '<file>' and then answers the resulting query with a LOCAL INFILE request for that file passes the check and receives the file's content.

Mitigation

MariaDB plc's Engineering Policy lists MariaDB Connector/J 2.7, 3.3, 3.4 and 3.5 as its supported release series. Upstream has made no 3.1.x release since 3.1.4 (April 2023), so no 3.1.x release is available to address this issue. For more information, see here.

Where LOAD DATA LOCAL INFILE is not needed, setting the connection option allowLocalInfile=false stops the driver from sending local files to the server.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of MariaDB Connector/J that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• buxu (finder)