CVE-2026-72572

The CVSS 7.5 score for CVE-2026-72572 obscures a more serious reality. This is a path traversal in xmysql where req.query.name flows directly into path.join without sanitization, then to res.download—an unauthenticated remote file read affecting every deployment of this library. That's the first problem: the attack surface isn't one system, it's every application that depends on xmysql, and that footprint is invisible. The second problem is the 'all versions' disclosure. This isn't standard vulnerable-version language—it signals either an unmaintained library or one lacking security-release infrastructure. There is no patched version to upgrade to. Your remediation options narrow to: local path sanitization wrappers around the download function, removing the feature entirely, or compensating controls (WAF rules blocking ../ sequences, file-access alerting on the application process). The third problem is worse. This exact req.query-to-path.join-to-res.download chain has appeared in multiple Node.js CVEs since 2018. We keep seeing the same vulnerability class repeat because Express's request abstraction makes req.query feel like internal configuration rather than attacker input. Without genealogical tracking, each instance gets treated as novel when it's actually a known failure mode the ecosystem hasn't prevented. What should you do? Assume you're exposed if xmysql is in your dependency tree, because library-level vulnerabilities don't announce themselves the way application vulnerabilities do. The disclosure-to-exploitation window here isn't measured by CVSS—it's measured by when automated scanners update and attackers automate the PoC. Prioritize compensating controls now, plan for dependency removal, and treat this as a test case for how you track supply-chain exposure in libraries with unknown downstream footprints.

Reviewed through automated stages and approved by a human before publication.