A security flaw tracked as CVE-2026-44172 has been identified in specific versions of MariaDB, a popular open-source database system used by many websites. The issue impacts MariaDB versions 3.3.18 and 3.4.8, and can allow unauthorized parties to run harmful commands on your website's database if your site accepts unvetted visitor input (such as form entries, search terms, or URL parameters) and sends that input to the database using the text protocol and big5 character set.
The standard tool websites use to block these harmful database commands (called mysql_real_escape_string) does not work as intended in this specific scenario for the affected MariaDB versions, leaving the database vulnerable to a type of attack called SQL injection. If your site matches these conditions, bad actors could potentially send unauthorized commands to steal, modify, or delete data stored in your website's database.
The team that develops MariaDB has already released patched versions 3.3.19 and 3.4.9 that resolve this vulnerability.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-44172