A security flaw, tracked as CVE-2026-44172, has been identified in specific older versions of MariaDB, a popular open-source database system used by many websites to store content, user data, and other site information.
The issue affects MariaDB versions 3.3.18 and 3.4.8. Normally, a standard tool called mysql_real_escape_string() is designed to block a common type of attack called SQL injection by cleaning user-submitted input (like entries from contact forms or search bars) before it is sent to the database. But for sites running these affected versions, if this cleaning tool is used, data is sent via text protocol, and the big5 character set (a common encoding for Traditional Chinese content) is in use, this protection fails. Attackers could then run unauthorized, harmful commands on your database by sending malicious input through public-facing site features.
The MariaDB development team has released fixed versions 3.3.19 and 3.4.9 that resolve this vulnerability.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-44172
