CVE-2026-61082

Overview

MySQL Connector/J is the official JDBC Type 4 driver for MySQL, developed and released by the MySQL team at Oracle. It lets Java applications connect to and query MySQL servers over JDBC, and also implements the X DevAPI for document-store access. It is distributed as the Maven artifact com.mysql:mysql-connector-j and is a standard dependency in Java applications that talk to MySQL.

An information exposure vulnerability (CVE-2026-61082) has been identified in the LOAD DATA LOCAL INFILE handling of MySQL Connector/J, which allows a malicious or compromised MySQL server to read client files outside the directory set in allowLoadLocalInfileInPath, or make the client fetch arbitrary URLs, and receive their contents. This happens when the client application has enabled allowLoadLocalInfile.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects MySQL Connector/J versions 9.7.0 through 9.7.1.

Details

Module Info

• Product: MySQL Connector/J
• Affected packages: com.mysql:mysql-connector-j
• Affected versions: >=9.7.0 <=9.7.1
• GitHub repository: https://github.com/mysql/mysql-connector-j
• Published packages: https://central.sonatype.com/artifact/com.mysql/mysql-connector-j
• Package manager: Maven
• Fixed in:
  • OSS MySQL Connector/J 26.7.0
  • NES for MySQL Connector/J v8.0.35

Vulnerability Info

This Medium-severity vulnerability is found in the com.mysql:mysql-connector-j package in versions 9.7.0 through 9.7.1 of MySQL Connector/J. The same vulnerable code is also present in MySQL Connector/J 8.0.33.

When a client runs a LOAD DATA LOCAL INFILE statement, the MySQL server answers with the name of the file it wants the client to send, and the driver opens that name in NativeProtocol.getFileStream(). The file name comes from the server, not from the application. The allowLoadLocalInfileInPath connection property is meant to confine such reads to one directory, and allowUrlInLocalInfile lets the name be a URL. However, when allowLoadLocalInfile is set to true, the driver takes an unrestricted branch that never applies either safeguard:

if (allowLoadLocalInfile.getValue()) {
    // "LOAD DATA LOCAL INFILE" is enabled without restrictions.
    InputStream hookedStream = getLocalInfileInputStream();
    if (hookedStream != null) {
        return new BufferedInputStream(hookedStream);
    } else if (allowUrlInLocalInfile.getValue()) {
        // Look for ':'.
        if (fileName.indexOf(':') != -1) {
            try {
                URL urlFromFileName = new URL(fileName);
                return new BufferedInputStream(urlFromFileName.openStream());
            } catch (MalformedURLException e) {
                // Ignore and fall back to trying this as a file input stream.
            }
        }
    }
    return new BufferedInputStream(new FileInputStream(new File(fileName).getCanonicalFile()));
}

In this branch, a directory set in allowLoadLocalInfileInPath is ignored, so the server can name any file the client process can read and the driver streams its contents back to the server. With allowUrlInLocalInfile also enabled, any server-supplied name containing : is passed to new URL(fileName).openStream() without the protocol and loopback-host checks that the restricted branch performs. This lets the server make the client fetch http:, ftp:, jar: or remote file: URLs, including internal resources reachable only from the client host, and return what it fetched. An attacker who controls the server, or who can redirect the client to a server they control, can therefore read local files and internal resources from the client host.

Mitigation

MySQL Connector/J is maintained by Oracle, which ships fixes only in the current Connector/J release line; older lines no longer receive updates. For more information, see the MySQL Product Support EOL Announcements.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to supported versions of MySQL Connector/J.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.