CVE-2025-62611

aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/aio-libs/aiomysql/commit/32c4520dae3711367ded74a4726dcb8bb8919538
https://github.com/aio-libs/aiomysql/pull/1044
https://github.com/aio-libs/aiomysql/security/advisories/GHSA-r397-ff8c-wv2g

Configurations

No configuration.

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) aiomysql es una biblioteca para acceder a una base de datos MySQL desde asyncio. Antes de la versión 0.3.0, la configuración del lado del cliente no se verifica antes de enviar archivos locales al servidor MySQL, lo que permite obtener archivos arbitrarios del cliente utilizando un servidor malicioso. Es posible crear un servidor MySQL malicioso que emula la autorización, ignora las banderas del cliente y solicita archivos arbitrarios del cliente enviando un paquete de instrucción LOAD_LOCAL. Este problema ha sido parcheado en la versión 0.3.0.

Information

Published : 2025-10-22 20:15

Updated : 2026-10-08 11:10

NVD link : CVE-2025-62611

Mitre link : CVE-2025-62611

CVE.ORG link : CVE-2025-62611

JSON object : View

Products Affected

No product.

CWE

CWE-73

External Control of File Name or Path

{"id": "CVE-2025-62611", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62611", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-22T19:43:26.205406Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "aio-libs", "product": "aiomysql", "versions": [{"status": "affected", "version": "< 0.3.0"}]}]}], "published": "2025-10-22T20:15:38.363", "references": [{"url": "https://github.com/aio-libs/aiomysql/commit/32c4520dae3711367ded74a4726dcb8bb8919538", "source": "security-advisories@github.com"}, {"url": "https://github.com/aio-libs/aiomysql/pull/1044", "source": "security-advisories@github.com"}, {"url": "https://github.com/aio-libs/aiomysql/security/advisories/GHSA-r397-ff8c-wv2g", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0."}, {"lang": "es", "value": "aiomysql es una biblioteca para acceder a una base de datos MySQL desde asyncio. Antes de la versi\u00f3n 0.3.0, la configuraci\u00f3n del lado del cliente no se verifica antes de enviar archivos locales al servidor MySQL, lo que permite obtener archivos arbitrarios del cliente utilizando un servidor malicioso. Es posible crear un servidor MySQL malicioso que emula la autorizaci\u00f3n, ignora las banderas del cliente y solicita archivos arbitrarios del cliente enviando un paquete de instrucci\u00f3n LOAD_LOCAL. Este problema ha sido parcheado en la versi\u00f3n 0.3.0."}], "lastModified": "2026-10-08T11:10:00.250", "sourceIdentifier": "security-advisories@github.com"}