Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M
CVE-2026-61700MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests
Low 3.7
In plain English
A low-severity improper access control in mariadb-connector-j from mariadb-corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sends a LOAD DATA LOCAL INFILE COM_QUERY, a rogue or man-in-the-middle server can echo the same filename and cause the connector to transmit that file despite the disabled option. The server cannot redirect the request to an arbitrary path and can receive only the exact file already selected by the application, so exploitation requires an application that actively loads sensitive data over an untrusted connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | mariadb-connector-java | no fix listed | DEBIAN-CVE-2026-61700 |
| Debian:14 | mariadb-connector-java | 2.7.15-1 | DEBIAN-CVE-2026-61700 |
| Maven | org.mariadb.jdbc:mariadb-java-client | 3.3.5 | GHSA-wxmm-q36w-r9xj |
| Maven | org.mariadb.jdbc:mariadb-java-client | 2.7.14 | GHSA-wxmm-q36w-r9xj |
| Maven | org.mariadb.jdbc:mariadb-java-client | 3.4.3 | GHSA-wxmm-q36w-r9xj |
| Maven | org.mariadb.jdbc:mariadb-java-client | 3.5.9 | GHSA-wxmm-q36w-r9xj |
| Ubuntu:22.04:LTS | mariadb-connector-java | no fix listed | UBUNTU-CVE-2026-61700 |
| Ubuntu:24.04:LTS | mariadb-connector-java | no fix listed | UBUNTU-CVE-2026-61700 |
| Ubuntu:26.04:LTS | mariadb-connector-java | no fix listed | UBUNTU-CVE-2026-61700 |
| Ubuntu:26.10 | mariadb-connector-java | no fix listed | UBUNTU-CVE-2026-61700 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mariadb-corporation | mariadb-connector-j | < 2.7.14>= 3.0.0, < 3.3.5>= 3.4.0, < 3.4.3>= 3.5.0, < 3.5.9 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-wxmm-q36w-r9xj x_refsource_CONFIRM
- https://github.com/mariadb-corporation/mariadb-connector-j/commit/0205d8be947918566cd9ce5a9db149541bbc8dee x_refsource_MISC
- https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.9 x_refsource_MISC