HackerOne Bug Bounty Disclosure: missing-file-privilege-enforcement-in-connect-file-udfs-allows-server-side-file-read-and-write-duong

Report title Missing FILE-privilege enforcement in CONNECT file UDFs allows server-side file read and write

Report link

Date submitted 2026-10-07T19:53:34.216Z

A vulnerability in MariaDB’s CONNECT plugin allowed users with only basic database read access to use certain file-related functions to read and write files on the database server. These functions did not apply the same permission checks as MariaDB’s built-in file access or CONNECT’s file-backed tables.

Normally, reading files through SQL requires the powerful FILE privilege, and the server’s secure_file_priv setting can restrict which directories are accessible. The affected CONNECT functions did not enforce either restriction. A user who could call the functions could potentially read files accessible to the MariaDB process, such as configuration files, or write files in locations where that process had permission.

How it could be exploited

The report demonstrated the issue with CONNECT’s JSON and BSON file functions. A low-privilege database user could call a read function on a server-side file, or use a write function to create a file outside the directory allowed by secure_file_priv. The files were accessed using the operating-system permissions of the MariaDB server process.

What the vulnerability did not allow

The report did not demonstrate direct operating-system command execution. In particular, writing a file did not by itself allow the attacker to install a MariaDB plugin or gain code execution on a standard installation.

What caused the issue

The CONNECT engine already checked for the FILE privilege and enforced secure_file_priv when handling file-backed tables. The corresponding checks were missing from several CONNECT file-related user-defined functions, leaving those functions as a way around the intended restrictions.

MariaDB confirmed the issue, said it would be fixed in a subsequent release, and later marked the report resolved. Users of the CONNECT plugin should install a release containing the fix and limit access to file-related functions to trusted database users. The report also recommends documenting clearly that these functions access files on the server.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.

HackerOne report summary

Programme

Submitted by Duong Tran

Profile

Report title Missing FILE-privilege enforcement in CONNECT file UDFs allows server-side file read and write

Report link

Date submitted 2026-10-07T19:53:34.216Z

A vulnerability in MariaDB’s CONNECT plugin allowed users with only basic database read access to use certain file-related functions to read and write files on the database server. These functions did not apply the same permission checks as MariaDB’s built-in file access or CONNECT’s file-backed tables.

Normally, reading files through SQL requires the powerful FILE privilege, and the server’s secure_file_priv setting can restrict which directories are accessible. The affected CONNECT functions did not enforce either restriction. A user who could call the functions could potentially read files accessible to the MariaDB process, such as configuration files, or write files in locations where that process had permission.

How it could be exploited

The report demonstrated the issue with CONNECT’s JSON and BSON file functions. A low-privilege database user could call a read function on a server-side file, or use a write function to create a file outside the directory allowed by secure_file_priv. The files were accessed using the operating-system permissions of the MariaDB server process.

What the vulnerability did not allow

The report did not demonstrate direct operating-system command execution. In particular, writing a file did not by itself allow the attacker to install a MariaDB plugin or gain code execution on a standard installation.

What caused the issue

The CONNECT engine already checked for the FILE privilege and enforced secure_file_priv when handling file-backed tables. The corresponding checks were missing from several CONNECT file-related user-defined functions, leaving those functions as a way around the intended restrictions.

MariaDB confirmed the issue, said it would be fixed in a subsequent release, and later marked the report resolved. Users of the CONNECT plugin should install a release containing the fix and limit access to file-related functions to trusted database users. The report also recommends documenting clearly that these functions access files on the server.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.