---
title: "NET-DB-015 MySQL secure_file_priv Not Restricted"
canonical: https://openvapt.com/checks/NET-DB-015.html
html: https://openvapt.com/checks/NET-DB-015.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# NET-DB-015 MySQL secure_file_priv Not Restricted

secure_file_priv is not set, or is set to an empty value, so LOAD DATA and SELECT ... INTO OUTFILE can read and write anywhere the server process can.

- Domain: Network
- Severity: Medium
- Control category: Data Services
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N`
- CIS Controls v8: 4.1
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-73, CWE-250
- OWASP Top 10 2021: A05:2021
- OWASP ASVS 4.0.3: 14.1.3
- NIST SP 800-53 Rev. 5: CM-6, AC-6, SI-10
- Benchmark topic: Database server hardening (topic only, no benchmark text)

## Why It Matters

File import and export statements run with the database server's filesystem rights. Limiting them to one folder, or disabling them with NULL, stops an injected query from reading /etc files or dropping a web shell into the document root.

## How It Detects

Parses the option files for secure_file_priv (or secure-file-priv) under [mysqld]. NULL or a folder path passes; an explicit empty value fails. When the setting is absent, reads the server flavour and version (the MariaDB binary or option folder, installed packages in the dpkg status file or the allow-listed rpm -qa): fails on MariaDB and MySQL before 8.0, passes with a note on packaged MySQL 8.0 and later (restricted by default), and reports Incomplete when the version cannot be read.

## How to Fix

Add  secure_file_priv = NULL  (no file operations) or  secure_file_priv = /var/lib/mysql-files  under [mysqld] and restart in a maintenance window.

## How to Verify

```
SHOW VARIABLES LIKE 'secure_file_priv';  should print NULL or the chosen folder.
```

## Learn the Theory

- [P3 Network Exposure and Firewalls](https://openvapt.com/academy/p3.md)
- [P8 Data Services: Databases, File Shares, DNS and Mail](https://openvapt.com/academy/p8.md)
- [P19 Database, Mail and DNS Hardening](https://openvapt.com/academy/p19.md)

## References

- [MySQL 8.4 Reference Manual, secure_file_priv](https://dev.mysql.com/doc/refman/8.4/en/server-system-variables.html#sysvar_secure_file_priv)
- [MySQL 8.4 Reference Manual, Security Guidelines](https://dev.mysql.com/doc/refman/8.4/en/security-guidelines.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go

Run it: `openvapt scan --only NET-DB-015`. Read it offline: `openvapt explain NET-DB-015`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/NET-DB-015.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.