Xmysql
Monthly
Path traversal in o1lab/xmysql (all versions) allows unauthenticated remote attackers to read and download arbitrary files from the host server via a crafted query parameter. The flaw exists in lib/xapi.js at lines 338 and 424, where the unsanitized req.query.name value is joined with the working directory and passed directly to res.download(), enabling ../ sequences to escape the application root. No patch has been released and all versions are confirmed affected, making every exposed instance immediately actionable for attackers with network access.
Path traversal in o1lab/xmysql (all versions) allows unauthenticated remote attackers to read and download arbitrary files from the host server via a crafted query parameter. The flaw exists in lib/xapi.js at lines 338 and 424, where the unsanitized req.query.name value is joined with the working directory and passed directly to res.download(), enabling ../ sequences to escape the application root. No patch has been released and all versions are confirmed affected, making every exposed instance immediately actionable for attackers with network access.