MariaDB Connector/J versions before 3.3.7, 3.4.5, and 3.5.11 improperly validate LOAD DATA LOCAL INFILE file requests by searching for the file name text anywhere in the SQL command, including inside quoted identifiers and comments. This flaw allows a malicious or compromised server, or a man-in-the-middle, to trick the client into sending arbitrary local files readable by the JVM to the server. The vulnerability affects standard JDBC calls such as DatabaseMetaData.getImportedKeys() and getExportedKeys(). A fix is available that properly parses the SQL command to validate the file request.