The vulnerability in o1lab/xmysql affects all versions and is due to improper limitation of a pathname to a restricted directory (CWE-22). Specifically, the lib/xapi.js file at lines 338 and 424 uses the user-supplied req.query.name parameter directly in path.join(cwd, name) without sanitization before passing it to res.download(). This allows an attacker to craft a request with '../' sequences to traverse directories and download arbitrary files from the server filesystem. The CVSS v3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating a high-impact confidentiality breach without integrity or availability impact. No patch or official remediation is currently documented.

An unauthenticated remote attacker can exploit this vulnerability to read and download arbitrary files from the server hosting xmysql. This can lead to disclosure of sensitive information, potentially including system files or application secrets. There is no impact on integrity or availability according to the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoints or applying input validation and sanitization on the req.query.name parameter to prevent directory traversal sequences. Monitoring for unusual file download requests may help detect exploitation attempts.