A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user‑controlled req.query.name parameter in path.join(cwd, name) without sanitization before passing it to res.download, enabling directory traversal via ../ sequences to access sensitive system files.

All releases of the o1lab/xmysql package are affected, regardless of version. Each affected deployment exposes the vulnerability through the HTTP endpoint that accepts a name query string.

The CVSS score of 7.5 reflects a moderate‑to‑high severity. Exploitation requires only a simple HTTP request to the vulnerable endpoint; thus, the attack vector is remote over the network, unauthenticated at the application level. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, indicating that widespread, known exploitation has not yet been reported. Nevertheless, the ease of construction of the request and lack of authentication make the risk significant for exposed servers.