CVE-2025-62611
High
Description
aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0.
SeverityHigh
CVSS8.2
Exploit probability—
ProductAiomysql
PublishedOct 22, 2025
First seenOct 22, 2025
Weakness typeCWE-73CWE-73
How to fix
Update
- aiomysql0.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| aiomysqlPyPI | v < 0.3.0 | 0.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.