CVE-2026-59149 Details
Description
Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWith(staticBaseDir). That prefix test has no path-separator boundary, so a ../-escaped path whose absolute form string-prefixes the base directory passes, allowing an unauthenticated client to read files from sibling paths outside the served directory through HTTP sendFile, WebSocket, or callbacks. This issue is fixed in version 9.7.0.
A path traversal vulnerability has been identified in Mockoon versions prior to 9.7.0. This issue arises in the 'FILE' response type when the 'filePath' includes request data, such as query parameters. The vulnerability allows an unauthenticated client to access files from sibling directories outside the intended directory via HTTP, WebSocket, or callbacks. The root cause is a prefix-only check that fails to properly validate path boundaries, enabling exploitation by escaping relative paths.
Users are advised to update Mockoon to version 9.7.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 9, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mockoon/mockoon/security/advisories/GHSA-8wqc-v2q8-vff2 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/mockoon/mockoon/commit/b42bdfb7f82e83f0e81bea8e6fe41adf5ec82585 | [email protected] | Source CodeVendor |
| https://github.com/mockoon/mockoon/pull/2255 | [email protected] | Source CodeVendor |
| https://github.com/mockoon/mockoon/releases/tag/v9.7.0 | [email protected] | Release NotesVendor |
| https://github.com/mockoon/mockoon/security/advisories/GHSA-8wqc-v2q8-vff2 | [email protected] | AdvisoryExploitRemedyVendor |
| https://mockoon.com/releases/9.7.0 | [email protected] | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-23 | Relative Path Traversal | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mockoon | <= 9.6.1 (semver) |
CPE
Remediation
| |
| Mockoon CLI | <= 9.6.1 (semver) |
CPE
Remediation
| |
| Mockoon Commons Server | <= 9.6.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | New CVE Received | [email protected] |
| Jul 9, 2026 | CVE Modified | CISA-ADP |