PT-2026-107252

CVE-2026-85985: Authorization bypass in the CONNECT engine of @mariadb Server, the open-source database with 8.3k GitHub stars. UDFs like json file and jfile make read and write files without checking the FILE privilege or secure file priv. A low-privileged SQL account reaches any file the MariaD...