The vulnerability arises from the MariaDB Connector/J ClientMessage.validateLocalFileName() routine, which incorrectly accepts file paths embedded inside quoted identifiers, string literals, or comments in a LOAD DATA LOCAL INFILE statement. An attacker controlling the database server or intercepting traffic can return crafted metadata that includes an arbitrary file name. With allowLocalInfile enabled, the connector will then attempt to read that file from the client host, exposing its contents to the attacker. This flaw allows confidential data on the client machine to be read and exfiltrated because the connector trusts server-supplied identifiers without proper sanitization.

This issue affects MariaDB Connector/J versions 3.0.0 through 3.3.6, 3.4.4, and 3.5.10, corresponding to the released builds 3.0.0–3.3.6, 3.4.4, and 3.5.10. The product impacts Java applications that use the Connector/J library to connect to MariaDB or MySQL databases. The library is distributed by MariaDB Corporation.

The CVSS score is 5.9, indicating moderate severity. No EPSS score is available, so the likelihood of exploitation is unknown, and the vulnerability is not listed in CISA’s KEV catalog. The attack likely requires an attacker to control or compromise the database server or perform a man‑in‑the‑middle attack to return malicious identifiers. Once the connection is established and allowLocalInfile is enabled, the attacker can read any file readable by the client process, leading to data leakage.