CVE-2026-72572 — o1lab xmysql - Unauthenticated Path Traversal via name Query Parameter

CVE-2026-72572

o1lab xmysql - Unauthenticated Path Traversal via name Query Parameter PUBLISHED

Description (CNA)

A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.join(cwd, name) without sanitization before passing it to res.download, enabling directory traversal via ../ sequences to access sensitive system files.

Affected (CNA)

Vendor / product	Versions
o1lab / xmysql	affected 0

CWE

CWE-22

References

https://github.com/o1lab/xmysql
https://github.com/o1lab/xmysql/blob/master/lib/xapi.js

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.