p PatchFirst

CVE-2025-62611

CVE-2025-62611 · aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server

This page contains facts from public vulnerability sources. Check the original advisory before updating.

aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0.

CVSS 8.2 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • aiomysql

    Versions
    • < 0.3.0: Affected

    No fix published

  • aiomysql Debian:12

    Versions
    • 0.1.1-2
    • 0.3.2-1
    • 0.3.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • aiomysql Debian:13

    Versions
    • 0.1.1-2
    • 0.3.2-1
    • 0.3.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • aiomysql Debian:14

    Versions
    • 0.1.1-2
    Affected ranges
    • ECOSYSTEM: < 0.3.2-1

    Update to 0.3.2-1

  • aiomysql PyPI

    Versions
    • 0.0.1
    • 0.0.10
    • 0.0.11
    • 0.0.12
    • 0.0.13
    • 0.0.14
    • 0.0.15
    • 0.0.16
    • 0.0.17
    • 0.0.19
    • 0.0.2
    • 0.0.20
    • 0.0.21
    • 0.0.22
    • 0.0.3
    • 0.0.4
    • 0.0.5
    • 0.0.6
    • 0.0.7
    • 0.0.8
    • 0.0.9
    • 0.1.0
    • 0.1.0rc1
    • 0.1.0rc2
    • 0.1.1
    • 0.2.0
    Affected ranges
    • ECOSYSTEM: < 0.3.0

    Update to 0.3.0

  • aiomysql Ubuntu:20.04:LTS

    Versions
    • 0.0.20-1
    • 0.0.20-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • aiomysql Ubuntu:22.04:LTS

    Versions
    • 0.0.20-2
    • 0.0.20-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • aiomysql Ubuntu:24.04:LTS

    Versions
    • 0.1.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • aiomysql Ubuntu:25.10

    Versions
    • 0.1.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • aiomysql Ubuntu:26.10

    Versions
    • 0.3.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • aiomysql Ubuntu:26.04:LTS

    Versions
    • 0.1.1-2
    • 0.3.2-1
    • 0.3.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →