Vulnerability · Published Feb 20, 2025 · Assigned by GitHub_M

CVE-2025-27098Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler in graphql-mesh

Medium 5.8

In plain English

A medium-severity path traversal in graphql-mesh from ardatan. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.4%top 69.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in the static file handler allows any client to access the files in the server's file system. When `staticFiles` is set in the `serve` settings in the configuration file, the following handler doesn't check if `absolutePath` is still under the directory provided as `staticFiles`. Users have two options to fix vulnerability; 1. Update `@graphql-mesh/cli` to a version higher than `0.82.21`, and if you use `@graphql-mesh/http`, update it to a version higher than `0.3.18` 2. Remove `staticFiles` option from the configuration, and use other solutions to serve static files.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@graphql-mesh/cli	0.82.22	GHSA-j2wh-wrv3-4x4g
npm	@graphql-mesh/http	0.3.19	GHSA-j2wh-wrv3-4x4g

Affected products (as reported)

Vendor	Product	Versions
ardatan	graphql-mesh	@graphql-mesh/cli: >= 0.78.0, < 0.82.22@graphql-mesh/http: < 0.3.19

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

References

https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-j2wh-wrv3-4x4g x_refsource_CONFIRM