Threats tagged 'ghsa-9pgj-cxw3-gw33'

A path traversal vulnerability exists in all versions of o1lab/xmysql. It allows an unauthenticated remote attacker to read and download arbitrary files from the server by exploiting improper sanitization of user input in the file download functionality. The vulnerability arises from the use of a user-controlled parameter in a path join operation without validation, enabling directory traversal via '../' sequences.