Nixpkgs security tracker
NIXPKGS-2026-2137
GitHub issue
published 13 hours ago
Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
Permalink
CVE-2026-59149
6.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): Required (R)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): None (N)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): None (N)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse accepted
- @LeSuisse published on GitHub
Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWith(staticBaseDir). That prefix test has no path-separator boundary, so a ../-escaped path whose absolute form string-prefixes the base directory passes, allowing an unauthenticated client to read files from sibling paths outside the served directory through HTTP sendFile, WebSocket, or callbacks. This issue is fixed in version 9.7.0.
References
-
https://github.com/mockoon/mockoon/security/advisories/GHSA-8wqc-v2q8-vff2 exploitx_refsource_CONFIRM
-
https://github.com/mockoon/mockoon/pull/2255 x_refsource_MISC
-
https://github.com/mockoon/mockoon/releases/tag/v9.7.0 x_refsource_MISC
-
https://mockoon.com/releases/9.7.0 x_refsource_MISC
Affected products
mockoon
- ==< 9.7.0