CVE-2025-30224: 
Linux Debian vulnerability analysis and mitigation

MyDumper, a MySQL Logical Backup Tool, was found to contain a security vulnerability identified as CVE-2025-30224. The vulnerability was discovered and disclosed on April 1, 2025. The issue affects versions prior to 0.18.2-8, where the MySQL C client library (libmysqlclient) allows authenticated remote actors to read arbitrary files from client systems when connecting to untrusted MySQL servers (GitHub Advisory, NVD).

The vulnerability stems from the MySQL C client library's LOAD LOCAL INFILE query functionality. MyDumper has this local infile option enabled by default and lacks an option to disable it. When a client connects to an untrusted MySQL server, the server can craft specific responses that trigger arbitrary file reads on the client system. The vulnerability has been assigned a CVSS v4.0 score of 5.1 (MEDIUM) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N (GitHub Advisory).

The vulnerability allows authenticated remote actors to read arbitrary files from client systems, potentially leading to sensitive information disclosure. This can occur when clients connect to untrusted MySQL servers without explicitly disabling the local infile capability (GitHub Advisory).

A proof-of-concept exploit has been documented that demonstrates the vulnerability. The attack can be executed by setting up a malicious MySQL 5.7 server with specific configurations and utilizing the Rewriter Query Rewrite Plugin to trigger arbitrary file reads from the client system (GitHub Advisory).

The vulnerability has been fixed in version 0.18.2-8 of MyDumper. The fix introduces a new command --local-infile option, similar to the one that exists for the MySQL client, allowing users to control this functionality (GitHub Advisory).