CVE-2025-62611: aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server

October 22, 2025 (updated November 10, 2025)

The client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server.

References

github.com/advisories/GHSA-r397-ff8c-wv2g
github.com/aio-libs/aiomysql
github.com/aio-libs/aiomysql/commit/32c4520dae3711367ded74a4726dcb8bb8919538
github.com/aio-libs/aiomysql/pull/1044
github.com/aio-libs/aiomysql/security/advisories/GHSA-r397-ff8c-wv2g
nvd.nist.gov/vuln/detail/CVE-2025-62611

Code Behaviors & Features

Detect and mitigate CVE-2025-62611 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →