Insecure File Handling in MariaDB Connector/J Affects Multiple Versions
CVE-2026-119210
5.9MEDIUM
What is CVE-2026-119210?
The MariaDB Connector/J has a vulnerability that allows improper handling of file names via a malicious server. It critically checks input through a regular expression that may give unauthorized access to client-host files. This occurs when the 'allowLocalInfile' property is enabled, leading to possible data exposure through database queries. Users are urged to upgrade to versions 3.3.7, 3.4.5, or 3.5.11 to mitigate this risk effectively.
Affected Version(s)
mariadb-connector-j >= 3.0.0, < 3.3.7 < 3.0.0, 3.3.7
mariadb-connector-j >= 3.4.0, < 3.4.5 < 3.4.0, 3.4.5
mariadb-connector-j >= 3.5.0, < 3.5.11 < 3.5.0, 3.5.11