CVE-2021-3779: Ruby-MySQL Gem Client File Read

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-06-28 · updated 2026-06-17
Weakness: CWE-610

Description

A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and later.

Affected products

Tomita Masahiro ruby-mysql: before 2.10.0 — fixed in 2.10.0

How to fix

Upgrade to a fixed version: Tomita Masahiro ruby-mysql 2.10.0. Check the vendor advisory for mitigations.

References

https://www.rapid7.com/blog/post/2022/06/28/cve-2021-3779-ruby-mysql-gem-client-file-read-fixed/
https://www.rapid7.com/blog/post/2022/06/28/cve-2021-3779-ruby-mysql-gem-client-file-read-fixed/

Get alerted when CVE-2021-3779 or the next vulnerability affects your stack