CVE-2026-72572

Name of the Vulnerable Software and Affected Versions o1lab/xmysql (affected versions not specified)

Description An unauthenticated remote attacker can read and download arbitrary files from the server. The issue occurs in the lib/xapi.js file where the req.query.name parameter is used in path.join(cwd, name) without proper sanitization before being passed to the res.download() function. This allows directory traversal using ../ sequences to access sensitive system files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.