Homepage

External Control of File Name or Path Affecting airflow-3-compat package, versions <3.1.1-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.08% (23rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-AIRFLOW3COMPAT-13782985
  • published31 Oct 2025
  • disclosed22 Oct 2025
Report a new vulnerability Found a mistake?

Introduced: 22 Oct 2025

CVE-2025-62611  (opens in a new tab)
CWE-73  (opens in a new tab)

How to fix?

Upgrade Minimos:latest airflow-3-compat to version 3.1.1-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream airflow-3-compat package and not the airflow-3-compat package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0.