A security flaw, tracked as CVE-2026-44172, has been identified in specific versions of MariaDB, a popular open-source database tool used by many websites to store content, user information, and other site data. The affected versions are 3.3.18 and 3.4.8.
The flaw creates a gap in a common security measure designed to block SQL injection attacks, a type of cyber attack where bad actors send malicious commands through public input fields (like search bars, contact forms, or login boxes) to access, alter, or delete your website's stored data. Under specific conditions—when a site processes unvalidated user input, uses the standard mysql_real_escape_string security function, the text database protocol, and the big5 character set—these malicious commands can bypass the existing protection and reach your database even when that security tool is in use.
Updates that patch this flaw are already available for affected MariaDB versions, with fixes included in versions 3.3.19 and 3.4.9.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-44172
