🎯 New Report #3836021: Missing FILE-privilege enforcement in CONNECT file UDFs allows server-side file read and write
🔺Severity: High
👽 Reporter: duongtt
⭐️ Reputation: 128
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-01
⏰ Disclosed: 2026-10-07 19:53:34
📝 Summary: A privilege enforcement vulnerability was discovered in file user-defined functions (UDFs) of a database engine. The file UDFs failed to enforce FILE privilege requirements and secure file path restrictions that were already implemented in the file-backed table handler. This allowed users with only SELECT privileges to read arbitrary files accessible to the database process and write files outside the configured secure directory. The vulnerability affected multiple file-related UDFs and was reproducible on multiple versions of the database software. The issue resulted from file UDFs not performing the same access control checks that were already in place for equivalent table operations.
📂 Report JSON File: 3836021
@hackeronereports