CVE-2026-72572

The CVE concerns o1lab/xmysql (all versions) with a path traversal vulnerability in lib/xapi.js: lines 338 and 424 use user-supplied req.query.name in path.join(cwd, name) and pass it to res.download() without sanitization, enabling unauthenticated remote attackers to read/download arbitrary serv...