CVE-2026-72572: o1lab xmysql - Unauthenticated Path Traversal via name Query Parameter
A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.join(cwd, name) without sanitization before passing it to res.download, enabling directory traversal via ../ sequences to access sensitive system files.
Other sources
A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.join(cwd, name) without sanitization before passing it to res.download(), enabling directory traversal via ../ sequences to access sensitive system files.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72572?
The severity of CVE-2026-72572 is high, with a score of 7.5.
What type of vulnerability is CVE-2026-72572?
CVE-2026-72572 is classified as a path traversal vulnerability.
How does CVE-2026-72572 affect the application?
CVE-2026-72572 allows an unauthenticated remote attacker to read and download arbitrary files from the server.
How do I fix CVE-2026-72572?
To fix CVE-2026-72572, input validation and sanitization should be implemented for the req.query.name parameter.
Which versions of o1lab/xmysql are affected by CVE-2026-72572?
All versions of o1lab/xmysql are affected by CVE-2026-72572.