The vulnerability resides in the “lib/xapi.js” module of o1lab/xmysql, where the user supplied req.query.name parameter is concatenated with the current working directory using path.join without proper sanitization. This flaw falls under CWE-22 and permits an unauthenticated attacker to read and download arbitrary files from the server, jeopardising confidentiality of sensitive system data. No indication of availability or integrity impact is present in the description.

All releases of the o1lab/xmysql package are affected, regardless of version. Each affected deployment exposes the vulnerability through the HTTP endpoint that accepts a name query string.

The CVSS score of 7.5 reflects a moderate‑to‑high severity. Exploitation requires only a simple HTTP request to the vulnerable endpoint; thus, the attack vector is remote over the network, unauthenticated at the application level. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, indicating that widespread, known exploitation has not yet been reported. Nevertheless, the ease of construction of the request and lack of authentication make the risk significant for exposed servers.