A security flaw has been identified and fixed in MariaDB, a popular open-source database system used by many websites to store user data, site content, and other critical information. The issue impacts MariaDB versions 3.3.18 and 3.4.8. If a site running one of these versions takes input from visitors (like form submissions, search queries, or uploaded files), uses a standard built-in security function to clean that input before sending it to the database, and uses the big5 character set with text protocol for that data transfer, the cleaning function fails to block malicious input as intended. This could allow attackers to run unauthorized commands on the database, which may lead to data theft, unauthorized changes, or permanent data loss. Sites not using this specific combination of settings are not affected by this flaw. The vulnerability has been patched in updated MariaDB versions 3.3.19 and 3.4.9.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-44172