MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName() check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string literals, or comments instead of requiring a real statement. A malicious or compromised server, or a machine-in-the-middle attacker, could return crafted database or table identifiers that the connector reused in metadata or updatable-result queries, then answer with a LOCAL INFILE request for a client file. With allowLocalInfile enabled, this caused the connector to stream any readable client-host file named by the crafted text, including through DatabaseMetaData.getImportedKeys(), DatabaseMetaData.getExportedKeys(), or ResultSet.updateRow() paths. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.

Affected: Maven: org.mariadb.jdbc:mariadb-java-client

## Summary

MariaDB Connector/J checked a server's LOAD DATA LOCAL INFILE file request by searching the text of the command it had sent for `LOAD DATA LOCAL INFILE '<file>'`. The search also matched inside quoted identifiers, string literals and comments, so text returned by the server and re-used in a later query could satisfy it. A rogue or MitM server can read any file the client JVM can read.

## Details

When a server answers a command with a LOCAL INFILE request (`0xFB` packet), the connector opens the named file on the client host and streams it to the server, after verifying that the file corresponds to a `LOAD DATA LOCAL INFILE` of the command it sent (`ClientMessage.validateLocalFileName()`). That verification was a regular expression whose prefix accepted any character, so it answered "does the text appear anywhere in the SQL", including inside a backtick-quoted identifier.

Several driver paths put identifiers returned by the server straight back into their next query: `DatabaseMetaData.getImportedKeys()` and `getExportedKeys()` re-use database and table names from `SHOW DATABASES`, `SHOW TABLES` and the `REFERENCES` clause of `SHOW CREATE TABLE` output, and updatable result sets build their `UPDATE` and refresh `SELECT` from the schema and table names of the column definition packets. A server returning an identifier such as ``LOAD DATA LOCAL INFILE '/etc/passwd'`` makes the connector send ``SHOW CREATE TABLE `LOAD DATA LOCAL INFILE '/etc/passwd'`.`accounts` ``;…

Affected: Ubuntu:18.04:LTS: mariadb-connector-java, Ubuntu:20.04:LTS: mariadb-connector-java, Ubuntu:22.04:LTS: mariadb-connector-java, Ubuntu:24.04:LTS: mariadb-connector-java, Ubuntu:26.10: mariadb-connector-java, Ubuntu:26.04:LTS: mariadb-connector-java

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName() check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string literals, or comments instead of requiring a real statement. A malicious or compromised server, or a machine-in-the-middle attacker, could return crafted database or table identifiers that the connector reused in metadata or updatable-result queries, then answer with a LOCAL INFILE request for a client file. With allowLocalInfile enabled, this caused the connector to stream any readable client-host file named by the crafted text, including through DatabaseMetaData.getImportedKeys(), DatabaseMetaData.getExportedKeys(), or ResultSet.updateRow() paths. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.