MariaDB is a popular open-source database system used by many websites to store data like user information, product details, and site content. A security flaw has been identified in two specific older versions of this software: 3.3.18 and 3.4.8.
Even if a website uses a standard built-in security tool designed to block malicious database attacks, this flaw allows SQL injection attacks under specific conditions. This happens when the site accepts unvetted input from visitors, processes that input with the mysql_real_escape_string() tool, sends data to the database using the text protocol, and uses the big5 character set (a configuration for Traditional Chinese language content). SQL injection attacks can let unauthorized people access, change, or delete your site’s stored data, or take control of parts of your website.
The issue has been fixed in updated MariaDB versions 3.3.19 and 3.4.9. Only sites running the two affected older versions, and using the specific setup noted above, are at risk from this vulnerability.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-44172
