A security flaw has been identified in specific older versions of MariaDB, a widely used open-source database system that many websites rely on to store content, user account information, and other site data. The affected versions are 3.3.18 and 3.4.8.
This flaw can enable SQL injection attacks, which allow unauthorized users to run unapproved commands on your site's database, potentially letting them view, modify, or delete your stored data. The issue occurs when a site takes unvetted user input (such as data submitted via contact forms, search bars, or login fields), uses the standard mysql_real_escape_string() security function designed to block these types of attacks, and sends that input to the database using the text protocol and big5 character set. In this specific scenario, the standard security function fails to work as intended, leaving your site exposed.
The flaw has been patched in updated MariaDB versions 3.3.19 and 3.4.9. Sites running the affected older versions will no longer face this risk once updated to these patched releases.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-44172
