Tharavel

**Name of the Vulnerable Software and Affected Versions** MariaDB Connector/J versions prior to 2.7.14 MariaDB Connector/J versions prior to 3.3.5 MariaDB Connector/J versions prior to 3.4.3 MariaDB Connector/J versions prior to 3.5.9 **Description** MariaDB Connector/J fails to enforce the `allowLocalInfile=false` setting when processing a server-initiated LOCAL INFILE protocol packet `0xfb` within the `ClientMessage.readPacket()` function. If an application sends a `LOAD DATA LOCAL INFILE` COM QUERY, a rogue or man-in-the-middle server can echo the same filename, tricking the connector into transmitting the file content even if the security option is disabled. Exploitation is limited because the server cannot redirect the request to arbitrary paths and can only receive the specific file already selected by the application. This requires an application to actively load sensitive data over an untrusted connection. **Recommendations** Update MariaDB Connector/J to version 2.7.14 or later. Update MariaDB Connector/J to version 3.3.5 or later. Update MariaDB Connector/J to version 3.4.3 or later. Update MariaDB Connector/J to version 3.5.9 or later.