CVE-2026-59149

MediumCVSS 6.5

Published: 09/07/2026(UTC)Updated: 10/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

A vulnerability in Mockoon prior to version 9.7.0 allows an unauthenticated client to read files outside the served directory. The issue stems from an improper path check in the getSafeFilePath function that lacks a path-separator boundary, enabling bypass via ../ sequences.

Risk Assessment

An attacker can read sensitive system files or application data outside the intended directory, leading to information disclosure and potential attack escalation.

Recommendation

Upgrade Mockoon to version 9.7.0 or later immediately, which contains the fix for this vulnerability.

Other vulnerabilities in Mockoon

CVE-2026-59148High
A vulnerability in Mockoon prior to 9.7.0 allows an unauthenticated attacker to remotely read MOCKOON_* environment variables, write arbitrary process environment variables, modify mock API response bodies, read transaction logs, and purge application state via the admin API, which is enabled by default and requires no authentication.

Original NVD description (English source)

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWith(staticBaseDir). That prefix test has no path-separator boundary, so a ../-escaped path whose absolute form string-prefixes the base directory passes, allowing an unauthenticated client to read files from sibling paths outside the served directory through HTTP sendFile, WebSocket, or callbacks. This issue is fixed in version 9.7.0.