CVE-2026-119210

What it actually does

Bypass of filename validation in ClientMessage.validateLocalFileName() allows a malicious server or MITM to inject LOAD DATA LOCAL INFILE requests via crafted identifiers or metadata queries, causing the client to stream arbitrary local files when allowLocalInfile is enabled.

Why it matters to the business

Applications using the affected connector versions risk unauthorized exposure of sensitive client-side files to an attacker-controlled database server, potentially leading to data leakage with minimal attacker effort required.

How an attack unfolds

An attacker positions a malicious or compromised MariaDB/MySQL server or intercepts traffic; when the client performs metadata or update operations, the server returns crafted identifiers that trigger the vulnerable regex, causing the client to honor a subsequent LOCAL INFILE request and stream the named local file back to the attacker.

How to fix it

Upgrade MariaDB Connector/J to version 3.3.7 or later, 3.4.5 or later, or 3.5.11 or later. Disable allowLocalInfile wherever possible and avoid using updatable result sets or metadata methods against untrusted servers.

How to confirm the fix worked

Confirm the connector version is at or above a fixed release; test by attempting a connection to a server returning crafted identifiers while monitoring for unexpected LOCAL INFILE activity or file access attempts.

Typical attack path

1. Attacker controls or compromises a MariaDB/MySQL server reachable by the victim application
2. Victim application connects with allowLocalInfile enabled and performs queries involving DatabaseMetaData or updatable ResultSets
3. Server responds with maliciously crafted database/table identifiers or result metadata containing LOAD DATA LOCAL INFILE syntax
4. Connector's flawed regex accepts the injected text and issues a LOCAL INFILE request for an attacker-chosen client file
5. Client streams the requested file contents to the attacker-controlled server

How to detect it

Review application logs for unexpected LOAD DATA LOCAL INFILE requests or file access originating from the connector; inspect network traffic for responses containing suspicious quoted identifiers followed by file transfer requests; check process monitoring for reads of sensitive local files shortly after database metadata calls.

What your security team should do

• Immediately inventory all Java applications using MariaDB Connector/J and identify those on versions 3.0.0 through the vulnerable ranges
• Prioritize upgrade to 3.3.7, 3.4.5, or 3.5.11 within the next patch cycle given the two-day publication window
• Review connection configurations and set allowLocalInfile=false by default
• Monitor for any new exploit code or EPSS increases over the coming weeks