CVEvulnerability

CVE-2026-119210

5.9 MEDIUM EPSS 0.30% Published 2026-10-29 Modified 2026-11-03 Official page ↗

Exploitation and prioritisation

EPSS
0.30% chance of exploitation in the next 30 days · in the top 76.9% of all CVEs (2026-11-03)
CISA SSVC: exploitation
none
CISA SSVC: automatable
no
CISA SSVC: technical impact
partial
EU Vulnerability Database
EUVD-2026-113382

Affected packages

EcosystemPackageVulnerableFixed inAdvisory
Mavenorg.mariadb.jdbc:mariadb-java-client>= 3.0.0, < 3.3.73.3.7GHSA-fhx5-2xqw-2cgm
Mavenorg.mariadb.jdbc:mariadb-java-client>= 3.4.0, < 3.4.53.4.5GHSA-fhx5-2xqw-2cgm
Mavenorg.mariadb.jdbc:mariadb-java-client>= 3.5.0, < 3.5.113.5.11GHSA-fhx5-2xqw-2cgm
Status
Awaiting Analysis
Published
2026-10-29
Last modified
2026-11-03
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-20, CWE-73

Description

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName() check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string literals, or comments instead of requiring a real statement. A malicious or compromised server, or a machine-in-the-middle attacker, could return crafted database or table identifiers that the connector reused in metadata or updatable-result queries, then answer with a LOCAL INFILE request for a client file. With allowLocalInfile enabled, this caused the connector to stream any readable client-host file named by the crafted text, including through DatabaseMetaData.getImportedKeys(), DatabaseMetaData.getExportedKeys(), or ResultSet.updateRow() paths. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-73 External Control of File Name or Path weakness

Referenced by GitHub Advisory · alias (1)

  • GHSA-fhx5-2xqw-2cgm MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files advisory · Maven

References