MySQL server has access to client-side filesystem

Seems like that is the server shell, right?

> When PROGRAM is specified, the server executes the given command and reads from the standard output of the program, or writes to the standard input of the program. The command must be specified from the viewpoint of the server, and be executable by the PostgreSQL user.

Although the STDIN/STDOUT options seem a bit more ambiguous:

> When STDIN or STDOUT is specified, data is transmitted via the connection between the client and the server.

That explicitly requires superuser permissions. If you give those out, the user has plenty ways to code execution.

(And as mentioned elsewhere, that's server-side, not the server instructing the client to send files as in the tweet.)

The difference here is that it's the client filesystem, not the server filesystem.