Skip to content
Fencer Vulns
medium 6.5

CVE-2026-59149 json

Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

published 2026-07-09 4 mo ago modified 2026-09-11 58 d ago also GHSA-8wqc-v2q8-vff2 , EUVD-2026-42684

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWith(staticBaseDir). That prefix test has no path-separator boundary, so a ../-escaped path whose absolute form string-prefixes the base directory passes, allowing an unauthenticated client to read files from sibling paths outside the served directory through HTTP sendFile, WebSocket, or callbacks. This issue is fixed in version 9.7.0.

Patch / fix

  • npm @mockoon/commons-server 9.7.0
  • npm @mockoon/cli 9.7.0

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/mockoon/mockoon/security/advisories/GHSA-8wqc-v2q8-vff2 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
npm @mockoon/commons-server
<9.7.0
9.7.0
npm @mockoon/cli
<9.7.0
9.7.0

Affected products

  • mockoon mockoon

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
  • CWE-23 Relative Path Traversal

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.