CVE lookup

CVE-2026-72572

Pruva has a verified reproduction for CVE-2026-72572: Unauthenticated path traversal in xmysql `/download` allows arbitrary file read via unsanitized `req.query.name`.. The canonical evidence record is REPRO-2026-00324.

REPRO

REPRO-2026-00324

Package

xmysql · npm / JavaScript (Node.js, Express)

Severity

HIGH

Status

published

Open verified reproduction Plain text for agents NVD source