CVE-2026-61700

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61700
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61700.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61700
Aliases
Downstream
Published
2026-09-17T15:49:15Z
Modified
2026-09-18T08:08:47Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests
Details

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sends a LOAD DATA LOCAL INFILE COM_QUERY, a rogue or man-in-the-middle server can echo the same filename and cause the connector to transmit that file despite the disabled option. The server cannot redirect the request to an arbitrary path and can receive only the exact file already selected by the application, so exploitation requires an application that actively loads sensitive data over an untrusted connection. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61700.json"
}
References

Affected packages

Git / github.com/mariadb-corporation/mariadb-connector-j

Affected ranges

Type
GIT
Repo
https://github.com/mariadb-corporation/mariadb-connector-j
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
defeee068496e3f6312e775c7de864f1b06388d4
Fixed
f522a2f560c6e07d1d4b9a7957ed31bc57038af4
Introduced
c19f608838fdcb18fa81cab8a607afdaa5131a58
Fixed
606bb6d6cf8fc02dc723ec468b5f753680da0993
Introduced
8be57f3b4bd0b1112cf871d9426beda6919b3bb7
Fixed
df4ebe2c61293b7a79ab9dd440199544305d1f38
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.7.14"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.3.5"
        },
        {
            "introduced": "3.4.0"
        },
        {
            "fixed": "3.4.3"
        },
        {
            "introduced": "3.5.0"
        },
        {
            "fixed": "3.5.9"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.1.8
1.1.9
1.2.0
1.2.2
1.3.0
1.3.0-beta-1
1.3.0-beta-2
1.3.0-beta-3
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.3
1.5.5
1.5.6
1.5.8
1.5.9
2.*
2.0.0-RC
2.1.2
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.7.10
2.7.11
2.7.12
2.7.13
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
3.*
3.0.0-alpha
3.0.3
3.0.6
3.0.7
3.0.8
3.0.9
3.1.3
3.1.4
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.4.2
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.7
3.5.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61700.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "185210897925734049027086244423075167776",
            "length": 319
        },
        "id": "CVE-2026-61700-0460b895",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/defeee068496e3f6312e775c7de864f1b06388d4",
        "target": {
            "file": "src/test/java/org/mariadb/jdbc/BaseTest.java",
            "function": "isMaxscale"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "125394110267100948280344882787043056509",
            "length": 258
        },
        "id": "CVE-2026-61700-49c2c95c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38",
        "target": {
            "file": "src/test/java/org/mariadb/jdbc/integration/tools/TcpProxy.java",
            "function": "restart"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "45776714546164338723462641041249279583",
            "length": 172
        },
        "id": "CVE-2026-61700-4ba2ebab",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38",
        "target": {
            "file": "src/test/java/org/mariadb/jdbc/integration/tools/TcpProxySocket.java",
            "function": "TcpProxySocket"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "286206149843698329108931548984761100893",
            "length": 1831
        },
        "id": "CVE-2026-61700-57b1c6bd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38",
        "target": {
            "file": "src/test/java/org/mariadb/jdbc/integration/tools/TcpProxySocket.java",
            "function": "run"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "36080727073426881173041813986674935507",
                "313765164227671911998211239114637621924",
                "182427900561183839641512897885912926552",
                "18748215377197812477916482314913713494",
                "326836629880561258824752767660421169150",
                "134669326577623107767554211984084230369",
                "106521113647404475609534626428498840999",
                "127093795513238516185077971010441312007",
                "56529725908919675086179800335607480461",
                "37338405024323771495738158621111463575",
                "120265795765920731081143943464714656529",
                "220592647504481798153606571142269190598",
                "135818739705042006595954142288327108510",
                "122011331843447417156879060623967813612",
                "159907601509891109246439304229943076662",
                "33802407644098004969853588235889933940",
                "250209934825706533869256849015261967210",
                "10180165611358828545441238481820800450",
                "212834346401854957521920983440552735401",
                "791140364776958749155669315619166076",
                "139064770066582847583756338237549340977",
                "111911877464310049565434876779233978945",
                "321594774609313880527286188448185794172",
                "199502207441525298355629710598096598358",
                "37707325452777045990449543844442780944",
                "281530574884719255925048794541219262424",
                "286459214060737518764782150566586856711",
                "132948461189540838900000221056644710100",
                "249822736470852519968590863971879614269",
                "34326942853535270594812861105059438429",
                "284414272539814029761960672945609741080",
                "222773495349271569708503899218532563339",
                "9729861514101896943044901606940373330",
                "188488146291189372441307733007992556407",
                "132258122523427606744925274623816931681",
                "249822736470852519968590863971879614269",
                "321594774609313880527286188448185794172",
                "237786024258601652862330724871184312555",
                "302345350373462776965677230129492726038",
                "2388199116681132166371303471723905893",
                "116353898746934374757627904351828895778",
                "111911877464310049565434876779233978945",
                "45574379738724547161592875030803414249",
                "272619164285717546928115815887689865980",
                "185231575570899371475720430439458086471",
                "228739972331049026873518575240124533034",
                "286124374380645913018762924814290277228",
                "5203845429875158857575703168261928184",
                "48923195057283199900345112223702956096",
                "21934578017714404142788024947012531393",
                "147034241846726266933111612934612146907",
                "297695124607537869317260265828860813512",
                "12013061300143887006331338978698591760",
                "247054472446657027384684085108215205497",
                "292973987720881257323270487289048555562",
                "183812576523699701542514276040346460544",
                "144519087708191447236047301243032049722",
                "213531157934429060409992108638704260695",
                "162145923579123227095337208288085577738",
                "71559441021564197927130027159971801636",
                "212995715004167534551138280515283139977",
                "311783417700207935874770711517786420866",
                "268324232295078176290106445261216930810",
                "305139594093281744640475330745980177575",
                "318551564965847475033085482470490650938",
                "220337420951614415587463431259826714069",
                "192696909586776576116988866569652161854",
                "291800434925973361418919438811576385253",
                "223546901574062350602808886092972198541",
                "176816040358192686828080842518218685502",
                "54285854685218769414178712479157439816",
                "226626565849905700575738508471822099535",
                "291001845362477000441739434302895351304",
                "77262302017947235427470320575908061611",
                "140060465784639053568948441989331006507",
                "93467794650317567682927009028293101724",
                "32560000235401852851504518680724448742",
                "224485162770408943948617931171821113331",
                "12154321257645284595299422001740643185",
                "99956369956854937565959288873537634129",
                "2388199116681132166371303471723905893",
                "239710116751037206416449654653440454352",
                "210585912936909598087414701931544481935",
                "186608888182779395674068129750299962427",
                "161334761599599806820713599479122818247",
                "249822736470852519968590863971879614269",
                "275967535780645398801255054852287645826",
                "1757928844923681562295595033958700022",
                "52692077411421678799880544013545094020",
                "84867976818828499679110854996311744330",
                "120475662925348192104350581947768017674",
                "281001011996375552978131961693417349372"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-61700-5b54e526",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38",
        "target": {
            "file": "src/test/java/org/mariadb/jdbc/integration/tools/TcpProxySocket.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "289970532453041542688790833220504902617",
            "length": 283
        },
        "id": "CVE-2026-61700-6af75013",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38",
        "target": {
            "file": "src/test/java/org/mariadb/jdbc/integration/tools/TcpProxySocket.java",
            "function": "sendRst"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "283982539249216696084008895452993606702",
                "47346380725116475200665603837850942091",
                "212103373299154857707036805153242529199",
                "37020035592985614936281328248017706843"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-61700-7a7fff17",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38",
        "target": {
            "file": "src/test/java/org/mariadb/jdbc/integration/tools/TcpProxy.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "63537419803687200015418309072518510864",
            "length": 368
        },
        "id": "CVE-2026-61700-a25b5823",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38",
        "target": {
            "file": "src/test/java/org/mariadb/jdbc/integration/tools/TcpProxySocket.java",
            "function": "kill"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "256785738987381743653376132555694639944",
                "68727910757537263648139751933403397105",
                "299737602962380196508329329106861516084",
                "199629589759793507609483143677577197047",
                "95283212317998327544029625605673081170",
                "322788262573727276319129692285418808751",
                "194029478353950828363197234374977169676",
                "197056354458389135263618634574852168053",
                "13356345791544287112055878874098875073",
                "167882527907366622863897518138363941560",
                "53515382639599372886795338142543809582",
                "151664467116144830529837379748782198517",
                "102274171772077041731510278249774198069",
                "41804052608904477648882984701865935262",
                "199313348767260020767884016327716041457",
                "117513760966066909694289784647327715328",
                "56816739296230036131343654835708668775"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-61700-fd386a8c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/defeee068496e3f6312e775c7de864f1b06388d4",
        "target": {
            "file": "src/test/java/org/mariadb/jdbc/BaseTest.java"
        }
    }
]
vanir_signatures_modified 
"2026-09-18T08:08:47Z"