MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files

Summary MariaDB Connector/J checked a server's LOAD DATA LOCAL INFILE file request by searching the text of the command it had sent for LOAD DATA LOCAL INFILE ' '. The search also matched inside quoted identifiers, string literals and comments, so text returned by the server and re-used in a later query could satisfy it. A rogue or MitM server can read any file the client JVM can read. Details When a server answers a command with a LOCAL INFILE request (0xFB packet), the connector opens the named file on the client host and streams it to the server, after verifying that the file corresponds to a LOAD DATA LOCAL INFILE of the command it sent (ClientMessage.validateLocalFileName()). That verification was a regular expression whose prefix accepted any character, so it answered "does the text appear anywhere in the SQL", including inside a backtick-quoted identifier. Several driver paths put identifiers returned by the server straight back into their next query: DatabaseMetaData.getImportedKeys() and getExportedKeys() re-use database and table names from SHOW DATABASES, SHOW TABLES and the REFERENCES clause of SHOW CREATE TABLE output, and updatable result sets build their UPDATE and…

curl https://cve.zerocrew.in/api/cve/CVE-2026-119210