GHSA-FHX5-2XQW-2CGM
Vulnerability from github – Published: 2026-10-30 22:59 – Updated: 2026-10-30 22:59Summary
MariaDB Connector/J checked a server's LOAD DATA LOCAL INFILE file request by
searching the text of the command it had sent for
LOAD DATA LOCAL INFILE '<file>'. The search also matched inside quoted
identifiers, string literals and comments, so text returned by the server and
re-used in a later query could satisfy it. A rogue or MitM server can read any
file the client JVM can read.
Details
When a server answers a command with a LOCAL INFILE request (0xFB packet), the
connector opens the named file on the client host and streams it to the server,
after verifying that the file corresponds to a LOAD DATA LOCAL INFILE of the
command it sent (ClientMessage.validateLocalFileName()). That verification was a
regular expression whose prefix accepted any character, so it answered "does the
text appear anywhere in the SQL", including inside a backtick-quoted identifier.
Several driver paths put identifiers returned by the server straight back into
their next query: DatabaseMetaData.getImportedKeys() and getExportedKeys()
re-use database and table names from SHOW DATABASES, SHOW TABLES and the
REFERENCES clause of SHOW CREATE TABLE output, and updatable result sets build
their UPDATE and refresh SELECT from the schema and table names of the column
definition packets. A server returning an identifier such as
LOAD DATA LOCAL INFILE '/etc/passwd' makes the connector send
SHOW CREATE TABLE `LOAD DATA LOCAL INFILE '/etc/passwd'`.`accounts`; the
server answers it with a LOCAL INFILE request for /etc/passwd, the check
passes, and the file content is sent. On the getImportedKeys() path the
resulting error is swallowed and the application observes nothing. The same
applies to an application that interpolates identifiers obtained from the
server into its own queries.
The fix parses the command instead of searching it: string literals, quoted
identifiers and comments are skipped, statements are split on ;, and only a
LOAD DATA|XML [LOW_PRIORITY|CONCURRENT] LOCAL INFILE found at the start of a
statement is considered, its file literal or bound parameter being compared
exactly to the requested file.
Impact
Confidentiality: a malicious or compromised server, or a MitM, can read arbitrary
files from the host running the JDBC client (application configuration,
credential files, key stores, ...) through standard java.sql calls such as
DatabaseMetaData.getImportedKeys(), getExportedKeys() or
ResultSet.updateRow(). Exploitation requires control of the server side of the
connection and allowLocalInfile enabled (the default). Setting
allowLocalInfile=false is a workaround when LOAD DATA LOCAL INFILE is not
needed. No integrity or availability impact.
Credit
Reported by buxuwa (buxu) through HackerOne
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.mariadb.jdbc:mariadb-java-client"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.3.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.mariadb.jdbc:mariadb-java-client"
},
"ranges": [
{
"events": [
{
"introduced": "3.4.0"
},
{
"fixed": "3.4.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.mariadb.jdbc:mariadb-java-client"
},
"ranges": [
{
"events": [
{
"introduced": "3.5.0"
},
{
"fixed": "3.5.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-119210"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-73"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-30T22:59:49Z",
"nvd_published_at": "2026-10-29T21:17:20Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nMariaDB Connector/J checked a server\u0027s LOAD DATA LOCAL INFILE file request by\nsearching the text of the command it had sent for\n`LOAD DATA LOCAL INFILE \u0027\u003cfile\u003e\u0027`. The search also matched inside quoted\nidentifiers, string literals and comments, so text returned by the server and\nre-used in a later query could satisfy it. A rogue or MitM server can read any\nfile the client JVM can read.\n\n## Details\n\nWhen a server answers a command with a LOCAL INFILE request (`0xFB` packet), the\nconnector opens the named file on the client host and streams it to the server,\nafter verifying that the file corresponds to a `LOAD DATA LOCAL INFILE` of the\ncommand it sent (`ClientMessage.validateLocalFileName()`). That verification was a\nregular expression whose prefix accepted any character, so it answered \"does the\ntext appear anywhere in the SQL\", including inside a backtick-quoted identifier.\n\nSeveral driver paths put identifiers returned by the server straight back into\ntheir next query: `DatabaseMetaData.getImportedKeys()` and `getExportedKeys()`\nre-use database and table names from `SHOW DATABASES`, `SHOW TABLES` and the\n`REFERENCES` clause of `SHOW CREATE TABLE` output, and updatable result sets build\ntheir `UPDATE` and refresh `SELECT` from the schema and table names of the column\ndefinition packets. A server returning an identifier such as\n``LOAD DATA LOCAL INFILE \u0027/etc/passwd\u0027`` makes the connector send\n``SHOW CREATE TABLE `LOAD DATA LOCAL INFILE \u0027/etc/passwd\u0027`.`accounts` ``; the\nserver answers it with a LOCAL INFILE request for `/etc/passwd`, the check\npasses, and the file content is sent. On the `getImportedKeys()` path the\nresulting error is swallowed and the application observes nothing. The same\napplies to an application that interpolates identifiers obtained from the\nserver into its own queries.\n\nThe fix parses the command instead of searching it: string literals, quoted\nidentifiers and comments are skipped, statements are split on `;`, and only a\n`LOAD DATA|XML [LOW_PRIORITY|CONCURRENT] LOCAL INFILE` found at the start of a\nstatement is considered, its file literal or bound parameter being compared\nexactly to the requested file.\n\n## Impact\n\nConfidentiality: a malicious or compromised server, or a MitM, can read arbitrary\nfiles from the host running the JDBC client (application configuration,\ncredential files, key stores, ...) through standard `java.sql` calls such as\n`DatabaseMetaData.getImportedKeys()`, `getExportedKeys()` or\n`ResultSet.updateRow()`. Exploitation requires control of the server side of the\nconnection and `allowLocalInfile` enabled (the default). Setting\n`allowLocalInfile=false` is a workaround when LOAD DATA LOCAL INFILE is not\nneeded. No integrity or availability impact.\n\n## Credit\n\nReported by buxuwa (buxu) through HackerOne",
"id": "GHSA-fhx5-2xqw-2cgm",
"modified": "2026-10-30T22:59:50Z",
"published": "2026-10-30T22:59:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-fhx5-2xqw-2cgm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119210"
},
{
"type": "WEB",
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/4d2f8002399949ed7f138e9c0b75b69229538120"
},
{
"type": "WEB",
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/5812e0ca7574c3934915179b76f2e819a556d099"
},
{
"type": "WEB",
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/a4891f877f1c885a573194771c1ed0aacec0ce1d"
},
{
"type": "PACKAGE",
"url": "https://github.com/mariadb-corporation/mariadb-connector-j"
},
{
"type": "WEB",
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"
},
{
"type": "WEB",
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"
},
{
"type": "WEB",
"url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.