[MDEV-40323] CONNECT file udfs ignore FILE and secure_file_priv - Jira

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Blocker
Resolution: Fixed
Affects Version/s: 10.6(EOL), 10.11, 11.4, 11.8, 12.3
Fix Version/s: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2
Component/s: Storage Engine - Connect
Labels:
- Cloned

Bug Category:
Can result in unexpected behaviour

Description

CONNECT file UDFs (json_file, bson_file, jfile_make, bfile_make, jbin_file) check neither FILE nor secure_file_priv. CONNECT table file access does check both though, so apparently the intention is to check.

Reported by Duong Tran from CyStack

Attachments

Issue Links

links to

CVE-2026-85985

Activity

People

Assignee:: Sergei Golubchik

Reporter:: Sergei Golubchik

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 2026-07-09 10:17

Updated:: 5 days ago 18:49

Resolved:: 2026-08-01 09:56

Time Tracking

Estimated:

Remaining:

Logged:

1d 1h

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.