What’s Vulnerable › Vulnerabilities

CVE-2025-62611: aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server

• Severity: high (CVSS 8.2 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-22 · updated 2026-10-08
• Weakness: CWE-73

Description

aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0.

Affected products

• aio-libs aiomysql: before 0.3.0

References

• https://github.com/aio-libs/aiomysql/commit/32c4520dae3711367ded74a4726dcb8bb8919538
• https://github.com/aio-libs/aiomysql/pull/1044
• https://github.com/aio-libs/aiomysql/security/advisories/GHSA-r397-ff8c-wv2g

Get alerted when CVE-2025-62611 or the next vulnerability affects your stack