CVE-2025-62611: Aio-Libs Aiomysql

High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days.

aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0.

Affected products

• Aio-Libs Aiomysql: before 0.3.0 (fixed in 0.3.0)

Published 2025-10-22. Last modified 2026-10-08.