GHSA-wxmm-q36w-r9xj

Source

https://github.com/advisories/GHSA-wxmm-q36w-r9xj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wxmm-q36w-r9xj/GHSA-wxmm-q36w-r9xj.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-wxmm-q36w-r9xj

Aliases

CVE-2026-61700

Downstream

MINI (15)

Published

2026-09-17T16:29:53Z

Modified

2026-09-17T16:45:06Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

Details

Summary

MariaDB Connector/J does not enforce allowLocalInfile=false when processing server-initiated LOCAL INFILE requests (protocol packet type 0xfb). However, exploitation is constrained: the server can only request the exact filename the client already included in its LOAD DATA LOCAL INFILE query, it cannot redirect to arbitrary paths.

Details

When a client executes LOAD DATA LOCAL INFILE '/path/to/file', the connector sends the filename to the server as part of the COM_QUERY. A rogue or MitM server responds with a 0xfb packet echoing that same filename. The connector, without checking allowLocalInfile, transmits the file content.

The bypass is therefore limited to the file the application itself intended to load. The attacker cannot escalate to other files (e.g. /etc/passwd) unless the application's own query targets them.

The real-world risk is:

An application that uses LOAD DATA LOCAL INFILE on potentially sensitive files (credentials, exports, configs) and connects over an untrusted network.
allowLocalInfile=false is supposed to disable this entire mechanism as a defense-in-depth measure, but the flag is ignored.

Impact

The security guarantee of allowLocalInfile=false is not upheld, but practical exploitation requires both a MitM/rogue server and an application that actively uses LOCAL INFILE on sensitive data.

Credit

Reported by tharavel

Database specific

{
    "cwe_ids": [
        "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T16:29:53Z",
    "nvd_published_at": null,
    "severity": "LOW"
}

References

Affected packages

Maven

org.mariadb.jdbc:mariadb-java-client

Package

Name: org.mariadb.jdbc:mariadb-java-client; View open source insights on deps.dev
Purl: pkg:maven/org.mariadb.jdbc/mariadb-java-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.7.14

Affected versions

1.*

1.1.7

1.1.8

1.1.9

1.1.10

1.2.0

1.2.1

1.2.2

1.2.3

1.3.0-beta-1

1.3.0-beta-2

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.4.0-beta-1

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.5.0-RC1

1.5.1-RC

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.8.0

2.*

2.0.0-RC

2.0.1

2.0.2

2.0.3

2.1.0

2.1.1

2.1.2

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.2.6

2.3.0

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.5.0

2.5.1

2.5.2

2.5.3

2.5.4

2.6.0

2.6.1

2.6.2

2.7.0

2.7.1

2.7.2

2.7.3

2.7.4

2.7.5

2.7.6

2.7.7

2.7.8

2.7.9

2.7.10

2.7.11

2.7.12

2.7.13

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wxmm-q36w-r9xj/GHSA-wxmm-q36w-r9xj.json"

org.mariadb.jdbc:mariadb-java-client

Package

Name: org.mariadb.jdbc:mariadb-java-client; View open source insights on deps.dev
Purl: pkg:maven/org.mariadb.jdbc/mariadb-java-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.3.5

Affected versions

3.*

3.0.1-beta

3.0.2-rc

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.0.10

3.0.11

3.1.0

3.1.1

3.1.2

3.1.3

3.1.4

3.2.0

3.3.0

3.3.1

3.3.2

3.3.3

3.3.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wxmm-q36w-r9xj/GHSA-wxmm-q36w-r9xj.json"

org.mariadb.jdbc:mariadb-java-client

Package

Name: org.mariadb.jdbc:mariadb-java-client; View open source insights on deps.dev
Purl: pkg:maven/org.mariadb.jdbc/mariadb-java-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.4.0

Fixed

3.4.3

Affected versions

3.*

3.4.0

3.4.1

3.4.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wxmm-q36w-r9xj/GHSA-wxmm-q36w-r9xj.json"

org.mariadb.jdbc:mariadb-java-client

Package

Name: org.mariadb.jdbc:mariadb-java-client; View open source insights on deps.dev
Purl: pkg:maven/org.mariadb.jdbc/mariadb-java-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.5.0

Fixed

3.5.9

Affected versions

3.*

3.5.0

3.5.1

3.5.2

3.5.3

3.5.4

3.5.5

3.5.6

3.5.7

3.5.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wxmm-q36w-r9xj/GHSA-wxmm-q36w-r9xj.json"