CVE-2026-72572: xmysql Path Traversal Vulnerability

CVE-2026-72572 Overview

CVE-2026-72572 is a path traversal vulnerability [CWE-22] in the o1lab/xmysql Node.js REST API generator. The flaw affects all versions of the library. An unauthenticated remote attacker can read and download arbitrary files from the host by supplying crafted values to the name query parameter. The vulnerable code resides in lib/xapi.js at lines 338 and 424, where user input flows into path.join(cwd, name) and is passed directly to res.download without sanitization.

Critical Impact
Unauthenticated attackers can retrieve sensitive files including configuration files, credentials, and system files by injecting ../ sequences into requests.

Affected Products

o1lab/xmysql - all versions
Node.js applications embedding xmysql as a dependency
Deployments exposing xmysql endpoints to untrusted networks

Discovery Timeline

2026-08-10 - CVE-2026-72572 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72572

Vulnerability Analysis

The xmysql project auto-generates REST APIs on top of MySQL databases. Two download handlers in lib/xapi.js accept a name parameter from req.query and pass it into path.join(cwd, name). The joined path is then handed to Express res.download. Because path.join normalizes ../ segments rather than rejecting them, the attacker controls the final file path resolved on disk.

The vulnerability allows retrieval of any file readable by the Node.js process user. Targets include /etc/passwd, /etc/shadow when running as root, application source files, .env configurations, SSH keys, and MySQL credential files. Exploitation requires only network access to the xmysql HTTP endpoint and does not require authentication.

Root Cause

The root cause is missing input sanitization on the req.query.name parameter before file system access. The handlers trust user input to represent a filename within the current working directory. They do not validate that the resolved absolute path stays within cwd, and they do not filter directory traversal sequences such as ../ or encoded variants.

Attack Vector

An attacker sends an HTTP GET request to the vulnerable download endpoint with a name query value containing traversal sequences. For example, a request supplying name=../../../../etc/passwd causes path.join to resolve outside the intended directory and res.download to stream the target file back to the attacker. Review the xmysql source at lib/xapi.js for the affected handlers.

Detection Methods for CVE-2026-72572

Indicators of Compromise

HTTP requests containing ../ or URL-encoded %2e%2e%2f sequences in the name query parameter targeting xmysql endpoints
Access log entries showing successful 200 responses to download endpoints with unexpected file names such as passwd, shadow, or .env
Outbound file downloads from the Node.js process to unknown remote IP addresses
Unusual read access on sensitive system files by the account running xmysql

Detection Strategies

Inspect web server and reverse proxy logs for query strings containing traversal patterns targeting xmysql routes
Deploy a Web Application Firewall (WAF) rule that blocks ../ and its encoded variants in query parameters
Correlate process-level file reads by the Node.js runtime against an allowlist of expected paths

Monitoring Recommendations

Alert on any file read outside the application working directory by the xmysql process
Track spikes in HTTP download endpoint traffic from single source IPs
Enable audit logging on sensitive files such as /etc/passwd, /etc/shadow, and application secrets

How to Mitigate CVE-2026-72572

Immediate Actions Required

Remove xmysql from internet-facing deployments until a validated fix is available
Place the service behind authenticated reverse proxies and restrict access by IP allowlist
Run the Node.js process under a low-privilege user account to limit file exposure
Audit access logs for prior exploitation attempts referencing traversal patterns

Patch Information

At the time of publication, no vendor patch is listed for CVE-2026-72572. Consult the xmysql GitHub repository for updates. Operators should fork and patch the lib/xapi.js handlers to validate that the resolved path stays within the intended directory, using path.resolve and a prefix check against the base directory.

Workarounds

Deploy a WAF or reverse proxy rule that rejects requests with ../, ..\\, %2e%2e%2f, or %2e%2e/ in query parameters
Chroot or containerize the xmysql process so the runtime cannot read files outside its data directory
Disable or remove the download routes if they are not required by the application

bash

# Example nginx rule blocking path traversal on xmysql endpoints
location /api/ {
    if ($query_string ~* "(\.\./|%2e%2e%2f|%2e%2e/|\.\.\\)") {
        return 403;
    }
    proxy_pass http://xmysql_backend;
}