CVE-2025-62611
BaseFortify
Publication date: 2025-10-22
Last updated on: 2025-10-22
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| aio-libs | aiomysql | 0.2.0 |
| aio-libs | aiomysql | 0.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-73 | The product allows user input to control or influence paths or file names that are used in filesystem operations. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive files from your client system to an attacker-controlled MySQL server. Since exploitation requires no privileges or user interaction and can be performed remotely over the network, an attacker can easily exfiltrate arbitrary files, potentially exposing confidential data, credentials, or other sensitive information stored on the client machine. [3, 1]
Can you explain this vulnerability to me?
This vulnerability in the aiomysql Python library allows a malicious MySQL server to trick the client into sending arbitrary local files. Before version 0.3.0, the client did not properly verify or restrict local file access requests from the server. A rogue server can emulate authorization, ignore client flags, and send LOAD_LOCAL instruction packets to retrieve files from the client system without permission. This flaw enables attackers controlling or impersonating a MySQL server to exfiltrate sensitive files from the client machine. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves monitoring for unusual LOAD_LOCAL instruction packets sent from your aiomysql client to MySQL servers, especially when connecting to untrusted or unknown servers. Since the vulnerability allows a rogue server to request arbitrary local files, you can inspect network traffic for unexpected LOAD_LOCAL commands or file transfer activity. Additionally, reviewing client logs for unexpected file access or transfers triggered by MySQL connections may help. Specific commands are not provided in the resources, but using network packet capture tools like tcpdump or Wireshark to filter MySQL protocol traffic and searching for LOAD_LOCAL packets can be effective. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, upgrade the aiomysql library to version 0.3.0 or later, where the issue is patched. The fix requires explicitly enabling the local_infile parameter on the client side to allow local file loading, preventing unauthorized file access by rogue servers. Until upgrading, avoid connecting to untrusted MySQL servers and disable any local file loading features if possible. Applying the patch from Pull Request #1044 or equivalent security updates is recommended to enforce proper verification of LOAD_LOCAL requests. [1, 3]