Threats affecting pkg:maven/org.mariadb.jdbc/mariadb-connector-j

CVE-2026-61700 is an improper access control vulnerability in MariaDB Connector/J affecting versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9. The flaw allows a rogue or man-in-the-middle server to cause the connector to transmit a local file despite the allowLocalInfile option being disabled, but only the exact file requested by the application can be sent. Exploitation requires an application that loads sensitive data over an untrusted connection. This issue has a CVSS score of 3.7 (medium severity) and is fixed in the specified versions.