The vulnerability in o1lab/xmysql occurs in the lib/xapi.js file at lines 338 and 424, where the user-controlled req.query.name parameter is used directly in path.join(cwd, name) without sanitization. This allows an attacker to craft a path traversal payload using '../' sequences to access and download arbitrary files from the server. The flaw affects all versions of the software. The CVSS 3.1 base score is 7.5, indicating high severity, with attack vector network, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

An unauthenticated remote attacker can exploit this vulnerability to read and download arbitrary files from the affected server, potentially exposing sensitive system or application data. There is no impact on integrity or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected service and monitor for suspicious requests attempting directory traversal patterns. Avoid exposing the vulnerable functionality to untrusted users.