{"id":"CVE-2025-62611","title":"aiomysql is a library for accessing a MySQL database from the asyncio","summary":"aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client us…","severity":"high","cwe":["CWE-73"],"vendor":"aiomysql","product":"aiomysql","affected":["aiomysql < 0.3.0"],"patched":["aiomysql 0.3.0"],"published":"2025-10-22","updated":"2026-10-08","sourceUpdated":"2026-10-08T11:10:00.250","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-62611","references":[{"url":"https://github.com/aio-libs/aiomysql/commit/32c4520dae3711367ded74a4726dcb8bb8919538","label":"security-advisories@github.com"},{"url":"https://github.com/aio-libs/aiomysql/pull/1044","label":"security-advisories@github.com"},{"url":"https://github.com/aio-libs/aiomysql/security/advisories/GHSA-r397-ff8c-wv2g","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62611"},{"url":"https://github.com/aio-libs/aiomysql"}],"tags":["nvd","osv","pip"],"epss":0.00391,"epssPercentile":0.33088,"aliases":["GHSA-r397-ff8c-wv2g","PYSEC-2026-1110"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:52.630Z","slug":"CVE-2025-62611","body":"## Overview\n\naiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2025-62611)\n\nAffected packages:\n\n- `aiomysql < 0.3.0`\n\nPatched in:\n\n- `aiomysql 0.3.0`\n\nSource: https://osv.dev/vulnerability/GHSA-r397-ff8c-wv2g","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}