CVE-2025-30224CWE-200

MyDumper arbitrary file read issue

Medium · published April 1, 2025

CVSS v4.0
5.1
EPSS
1%
Percentile
54.4
In the wild
Unconfirmed
What it is

MyDumper is a MySQL Logical Backup Tool. The MySQL C client library (libmysqlclient) allows authenticated remote actors to read arbitrary files from client systems via a crafted server response to LOAD LOCAL INFILE query, leading to sensitive information disclosure when clients connect to untrusted MySQL servers without explicitly disabling the local infile capability. Mydumper has the local infile option enabled by default and does not have an option to disable it. This can lead to an unexpected arbitrary file read if the Mydumper tool connects to an untrusted server. This vulnerability is fixed in 0.18.2-8.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00749 · 54.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-04-01T14:38Z
EPSS history
Timeline
  • 01 APR 14:38Z
    MyDumper arbitrary file read issue
    cvelistv5