CData API Server Vulnerability Exposing Sensitive Information Through MySQL Misconfiguration

CVE-2025-9273

What is CVE-2025-9273?

A vulnerability exists in the CData API Server that allows remote attackers to potentially disclose sensitive information. This flaw stems from a misconfiguration in the MySQL connection settings, which permits the server to request local files from the MySQL client. While authentication is required to exploit this weakness, it poses a significant risk by allowing access to sensitive information in the context of NETWORK SERVICE. Organizations using the CData API Server should apply necessary security measures to mitigate this risk.

References