A security flaw has been found in MariaDB versions 3.3.18 and 3.4.8. MariaDB is a popular community-developed database system, forked from MySQL, that many websites use to store information like user accounts, content, and transaction data.
The vulnerability affects websites using these MariaDB versions that accept unvetted visitor input (such as form submissions, search queries, or comment entries), use the standard mysql_real_escape_string() tool that is supposed to block database attacks, send that input to the database via text protocol, and use the big5 character set for database connections. In these cases, the safeguard fails, leaving the site open to SQL injection attacks. These attacks could let bad actors access, modify, or delete your site's stored data, or even take control of sections of your website.
The flaw has been fixed in updated MariaDB versions 3.3.19 and 3.4.9.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-44172
