SELECT ... INTO OUTFILE does not enforce the FILE WRITE privilege unprivileged arbitrary file write on the server

Summary

A security researcher reported a privilege escalation vulnerability in SingleStore's self-managed database server where the SELECT...INTO OUTFILE command did not properly enforce the FILE WRITE privilege. This authorization bypass (CWE-862) allowed any authenticated user, including those with only USAGE privileges, to write arbitrary files to the aggregator host at any path, written as the engine OS user. The vulnerability affected default-configuration self-managed deployments, though SingleStore Helios was not impacted due to the local_file_system_access_restricted setting. Customers running affected versions could mitigate this issue by enabling the local_file_system_access_restricted configuration flag if not done already. SingleStore has patched this issue and the fix will be reflected in the next patch versions of supported SingleStoreDB releases.