CVE-2025-59049 Mockoon has a Path Traversal and LFI in the static file serving endpoint
An attacker can exploit path traversal in Mockoon's static file serving to read arbitrary files from the server filesystem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59049?
CVE-2025-59049 is a high-severity path traversal vulnerability in mockoon, published on 10 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same approach presented in the documentation page, where the server filename is generated via templating features from user input is vulnerable to Path Traversal and LFI, allowing an attacker to get any file in the mock server filesystem. The issue may be particularly relevant in cloud hosted server instances. Version 9.2.0 fixes the issue.
Which versions are affected by CVE-2025-59049?
4 open source packages ship an affected version, including @mockoon/cli and @mockoon/commons-server.
| Package | Affected | Fixed in |
|---|---|---|
@mockoon/cli npm | All versions | 9.2.0 |
@mockoon/cli npm | All versions | 9.2.0 |
@mockoon/commons-server npm | All versions | 9.2.0 |
@mockoon/commons-server npm | All versions | 9.2.0 |
How do I fix CVE-2025-59049?
Upgrade @mockoon/cli to 9.2.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-59049 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59049 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-w7f9-wqc4-3wxr.