The vulnerability exists in the CONNECT engine file‑access user‑defined functions (UDFs) such as json_file, bson_file, jfile_make, bfile_make, and jbin_file. These functions fail to enforce the FILE privilege and ignore the secure_file_priv configuration, allowing a low‑privileged user to specify arbitrary filesystem paths. By calling the UDFs, an attacker can read or write files on the host that the database account is not normally authorized to access, limited only by the operating‑system permissions of the database process.

MariaDB server versions 10.6.1 through 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 are affected.

The CVSS score is 5.4, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires the attacker to be able to execute a UDF within the database, meaning any database user with access can exploit it. While the flaw does not permit arbitrary code execution, it allows unauthorized reading or writing of files, which could expose confidential data or modify system files, thereby potentially facilitating further attacks.