CVE-2026-61700: MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests
mariadb-corporation · mariadb-connector-j
Affected: mariadb-corporation mariadb-connector-j · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 30% of scored CVEs
DescriptionCVE.org
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sends a LOAD DATA LOCAL INFILE COM_QUERY, a rogue or man-in-the-middle server can echo the same filename and cause the connector to transmit that file despite the disabled option. The server cannot redirect the request to an arbitrary path and can receive only the exact file already selected by the application, so exploitation requires an application that actively loads sensitive data over an untrusted connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- mariadb-corporation · mariadb-connector-j< 2.7.14; >= 3.0.0, < 3.3.5; >= 3.4.0, < 3.4.3; >= 3.5.0, < 3.5.9
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- mariadb-corporation
- Published
- September 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-61700 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.