Vulnerability · Published Jul 9, 2026 · Assigned by GitHub_M

CVE-2026-59149Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

Medium 6.5

In plain English

A medium-severity path traversal in mockoon from mockoon. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 58.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWith(staticBaseDir). That prefix test has no path-separator boundary, so a ../-escaped path whose absolute form string-prefixes the base directory passes, allowing an unauthenticated client to read files from sibling paths outside the served directory through HTTP sendFile, WebSocket, or callbacks. This issue is fixed in version 9.7.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@mockoon/cli	9.7.0	GHSA-8wqc-v2q8-vff2
npm	@mockoon/commons-server	9.7.0	GHSA-8wqc-v2q8-vff2

Affected products (as reported)

Vendor	Product	Versions
mockoon	mockoon	< 9.7.0

Weakness: CWE-22, CWE-23 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

https://github.com/mockoon/mockoon/security/advisories/GHSA-8wqc-v2q8-vff2 x_refsource_CONFIRM
https://github.com/mockoon/mockoon/pull/2255 x_refsource_MISC
https://github.com/mockoon/mockoon/commit/b42bdfb7f82e83f0e81bea8e6fe41adf5ec82585 x_refsource_MISC
https://github.com/mockoon/mockoon/releases/tag/v9.7.0 x_refsource_MISC
https://mockoon.com/releases/9.7.0 x_refsource_MISC