CVE-2026-59149 Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
An unauthenticated attacker can read files outside the served directory in Mockoon due to a flawed path validation check.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-59149?
CVE-2026-59149 is a medium-severity path traversal vulnerability in mockoon, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWith(staticBaseDir). That prefix test has no path-separator boundary, so a ../-escaped path whose absolute form string-prefixes the base directory passes, allowing an unauthenticated client to read files from sibling paths outside the served directory through HTTP sendFile, WebSocket, or callbacks. This issue is fixed in version 9.7.0.
Which versions are affected by CVE-2026-59149?
4 open source packages ship an affected version, including @mockoon/cli and @mockoon/commons-server.
| Package | Affected | Fixed in |
|---|---|---|
@mockoon/cli npm | All versions | 9.7.0 |
@mockoon/cli npm | All versions | 9.7.0 |
@mockoon/commons-server npm | All versions | 9.7.0 |
@mockoon/commons-server npm | All versions | 9.7.0 |
How do I fix CVE-2026-59149?
Upgrade @mockoon/cli to 9.7.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-59149 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59149 exists.
Sources
Also known as GHSA-8wqc-v2q8-vff2.