Executive brief
xmysql is a tool that exposes MySQL databases as a REST API. A path traversal vulnerability allows unauthenticated attackers to read and download arbitrary files from the server by manipulating file path parameters, potentially exposing sensitive system files and application data.
Technical details
The vulnerability exists in lib/xapi.js (lines 338 and 424) where user-supplied query parameters (req.query.name) are used unsanitized in path.join(cwd, name) before being passed to res.download(). An attacker can exploit this by injecting directory traversal sequences (e.g., ../) to escape the intended directory and access arbitrary files on the server. The vulnerability requires no authentication and is exploitable via network requests. No patch information is currently available for this vulnerability affecting all versions of xmysql.
Affected products
- o1lab xmysql all versions
Timeline
- 2026-08-10: disclosed