Description

A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.join(cwd, name) without sanitization before passing it to res.download(), enabling directory traversal via ../ sequences to access sensitive system files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T11:17:29.883Z",
  "pubdate": "2026-08-10T11:17:29.883Z",
  "executiveSummary": "A path traversal vulnerability exists in all versions of the o1lab/xmysql product, specifically within the lib/xapi.js file at lines 338 and 424.\nThe vulnerability allows an unauthenticated remote attacker to read and download arbitrary files from the underlying server filesystem.\nThe risk implication is severe, as successful exploitation grants unauthorized access to sensitive system configuration files, source code, and potentially system credentials.\nAttack capabilities are strictly remote and require no prior authentication or administrative privileges.\nExploitation is achieved by manipulating the user-controlled req.query.name parameter to supply directory traversal sequences such as dot-dot-slash (../), which bypass intended application boundaries when processed by the server.",
  "technicalDetails": "The root cause of the vulnerability is the lack of proper input validation and sanitization on user-supplied parameters before performing filesystem operations.\nSpecifically, the lib/xapi.js component at lines 338 and 424 directly incorporates the user-controlled req.query.name parameter into a path resolution operation using path.join(cwd, name).\nThe resulting path is subsequently passed directly to the Express framework res.download() function.\nBecause the input is not validated to ensure it remains within the intended working directory (cwd), an attacker can inject directory traversal sequences such as ../ into the name query parameter.\nThe step-by-step attack flow involves an unauthenticated remote attacker crafting an HTTP request targeting the vulnerable endpoint associated with lib/xapi.js.\nThe attacker appends traversal payloads containing multiple ../ sequences to the req.query.name parameter.\nThe Node.js path.join() function resolves these relative path sequences, navigating upward through the directory hierarchy from the application working directory to arbitrary locations on the host filesystem.\nThe res.download() function then processes the resulting absolute or relative path, retrieving the targeted file and transmitting its contents back to the remote attacker over the network.\nAffected versions include all versions of o1lab/xmysql.\nNo authentication or privileges are required, and the network exposure is fully remote, enabling external threat actors to compromise confidentiality."
}