CVE-2026-119210

A flaw was found in MariaDB Connector/J. This vulnerability can lead to information disclosure when client-side local file handling is enabled. A compromised database server or a machine-in-the-middle attacker can provide crafted database or table identifiers that bypass filename validation checks during query or metadata operations. As a result, the attacker can force the client application to transmit arbitrary readable files from the host system.

This vulnerability is rated as Moderate severity because successful exploitation requires an attacker to control a rogue database server or perform active network interception against database connections. In standard Red Hat deployments, Java applications connect to authenticated backend database instances across protected internal networks, which restricts exposure. Although an attacker in this position could read client-side files accessible to the application process, the flaw does not allow modifying data or executing code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the local file transfer feature by setting the allowLocalInfile connection option to false in the JDBC connection configuration.

In the JDBC connection string, append the property:

jdbc:mariadb://<host>:<port>/<database>?allowLocalInfile=false

Or set the parameter in application datasource properties:

allowLocalInfile=false

Additionally, ensure TLS with server certificate validation (such as sslMode=verify-full) is configured to protect against machine-in-the-middle tampering.

Caveats: Disabling this option prevents the application from executing LOAD DATA LOCAL INFILE commands to transfer client files to the database.

Warning: Modifying database connection parameters requires restarting the dependent application or service for changes to take effect.