What is the CVSS score of CVE-2026-72572?

CVE-2026-72572 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.8%.

Which versions of xmysql are affected by CVE-2026-72572?

xmysql instances across all versions are vulnerable to unauthenticated file disclosure (CVE-2026-72572), exposing configuration files, credentials, and sensitive server data to any network-connected…

How to fix or mitigate CVE-2026-72572?

Within 24 hours: identify all xmysql deployments in your environment and immediately disable external network access to any internet-facing instances. Within 7 days: implement network segmentation to restrict xmysql access to trusted internal networks only, deploy Web Application Firewall (WAF) rules to block path traversal patterns in the 'name' query parameter, and enable comprehensive audit logging. Within 30 days: evaluate alternative database query interface solutions as a long-term replacement, since xmysql has no available vendor patch and all versions remain vulnerable.

xmysql CVE-2026-72572

EUVD-2026-55234 HIGH

Path Traversal (CWE-22)

2026-08-10 TuranSec

GHSA-9pgj-cxw3-gw33

Path Traversal Xmysql

7.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-exploitable with no authentication or user interaction required; impact is confidentiality-only as traversal enables file read but not write or denial of service.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 11:19 vuln.today

CVE Published

Aug 10, 2026 - 10:40 cve.org

HIGH 7.5

DescriptionCVE.org

A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.join(cwd, name) without sanitization before passing it to res.download(), enabling directory traversal via ../ sequences to access sensitive system files.

AnalysisAI

Path traversal in o1lab/xmysql (all versions) allows unauthenticated remote attackers to read and download arbitrary files from the host server via a crafted query parameter. The flaw exists in lib/xapi.js at lines 338 and 424, where the unsanitized req.query.name value is joined with the working directory and passed directly to res.download(), enabling ../ sequences to escape the application root. No patch has been released and all versions are confirmed affected, making every exposed instance immediately actionable for attackers with network access.

Technical ContextAI

xmysql is a Node.js application that auto-generates a REST API layer over a MySQL database, commonly used for rapid prototyping. The vulnerability resides in lib/xapi.js, where the Express route handler accepts a user-supplied name query parameter and constructs a file path using Node.js's path.join(cwd, name). Critically, path.join resolves ../ segments - it does not strip or reject them - meaning a value like ../../../../etc/passwd yields a fully resolved path outside the application directory. The resulting path is then passed to Express's res.download(), which reads and streams the file to the HTTP client without any subsequent validation. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) precisely describes this root cause: the application fails to canonicalize or validate the path before file I/O. The affected CPE is cpe:2.3:a:o1lab:xmysql:*:*:*:*:*:*:*:*, confirming all published versions are affected.

RemediationAI

No vendor-released patch has been identified at time of analysis; the provided references point only to the upstream repository and source file with no advisory or tagged fix release. Until a patch is available, operators should immediately restrict network access to xmysql instances using firewall rules or network segmentation so the service is not reachable from untrusted networks - this is the most effective compensating control given the zero-authentication attack vector. As an additional layer, place xmysql behind an authenticated reverse proxy (e.g., nginx with HTTP basic auth or mutual TLS) to require credentials before any request reaches the application; note this adds operational overhead and does not fix the underlying flaw. Operators should also ensure the xmysql process runs as a least-privilege OS user with read access limited to the intended data directory, reducing the blast radius of a successful traversal. Monitor the GitHub repository at https://github.com/o1lab/xmysql for patch releases and apply immediately upon availability.