MySQL LOAD DATA LOCAL: why local_infile is off and when to enable it

LOAD DATA LOCAL is off by default in current MySQL because it lets the server choose which client file to read. A malicious or patched server could ask for any file the client user can read. Leave local_infile disabled, and enable it only for a trusted connection that runs a specific import.

How the risk works

With LOAD DATA LOCAL, the client reads a file from its own machine and sends it to the server. The MySQL manual explains that the server parses the statement and tells the client which file to transfer. A patched server could tell the client to send a file of its choosing, and the manual says such a server could access any file on the client host that the client user can read.

So the danger is a client connecting to a server it should not trust. The manual's advice is that clients should not connect to untrusted servers, and that using --ssl-mode=VERIFY_IDENTITY with the right CA certificate helps ensure you are talking to the intended server.

The web application angle

The manual also describes the case where the client is a web server. If a user can run arbitrary statements against the SQL server, they could use LOAD DATA LOCAL to read files the web server process can read. This ties the setting to SQL injection impact: an injection that can reach this statement turns from data theft into file theft on the application host. See SQL injection and what prepared statements cannot bind for the prevention side.

What the defaults are

According to the 8.4 manual:

• The server variable local_infile is disabled by default, a change from earlier versions.
• The client library default is set at build time by ENABLED_LOCAL_INFILE, and binary distributions ship with it disabled.
• Both sides must allow it. Otherwise you get ERROR 3950, saying loading local data is disabled and must be enabled on both client and server.

Older installs and old configuration files may still enable it, so check yours rather than assuming.

Enabling it for one import

If you need it for a bulk load:

1. Connect with a verified TLS mode, as described in MySQL TLS settings.
2. Use a dedicated account that has only the privileges the import needs.
3. Pass --local-infile=1 on that one client session instead of changing config files.
4. Consider the client option --load-data-local-dir, which the manual documents for restricting which directory local loading may read from.
5. Turn the server variable back off afterward if you changed it.

Related server side setting

secure_file_priv is a different control. The 8.4 page we read does not cover it, so check its own manual page. In general it relates to server side file operations rather than local loading, which reads from the client.

Quick check

Sources

• MySQL 8.4 Reference Manual: Security Considerations for LOAD DATA LOCAL

Last reviewed: 19 October 2026.