{"uuid": "eb5aac64-c17a-4bc5-8817-3efafd31c483", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-8wqc-v2q8-vff2", "type": "seen", "source": "https://gist.github.com/alon710/8e9884324f7c5a6dc21f24fa20ed79e2", "content": "# CVE-2026-59149: CVE-2026-59149: Sibling Directory Path Traversal in Mockoon Backend Server\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59149\n\n## Summary\nCVE-2026-59149 identifies a directory traversal vulnerability in `@mockoon/commons-server`, the backend mock-server library powering the Mockoon application. The flaw occurs in the path containment validation logic used during raw file response generation. An unauthenticated attacker can exploit this weakness to retrieve arbitrary files from sibling directories sharing a common prefix with the designated static base directory.\n\n## TL;DR\nA path traversal vulnerability in Mockoon's backend server allows unauthenticated clients to read files from sibling directories outside the configured base directory by exploiting character-by-character prefix validation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.5\n- **EPSS Score**: 0.00483 (0.48%)\n- **Impact**: Confidentiality (High)\n- **Exploit Status**: Proof of Concept / Public Details Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Mockoon Desktop Application\n- Mockoon CLI\n- @mockoon/commons-server npm package\n- **mockoon**: < 9.7.0 (Fixed in: `9.7.0`)\n- **@mockoon/commons-server**: < 9.7.0 (Fixed in: `9.7.0`)\n\n## Mitigation\n\n- Upgrade Mockoon applications and server components to version 9.7.0 or later.\n- Sanitize client input before processing template variables in file-serving endpoints.\n- Configure Mockoon execution environments to operate under the principle of least privilege.\n\n**Remediation Steps:**\n1. Run the command `npm install @mockoon/commons-server@latest` or update the parent application package configurations.\n2. Verify that path resolution checks execute using semantic relative path checking rather than string-prefix matching.\n3. Isolate Mockoon containers from sibling workspace environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-8wqc-v2q8-vff2](https://github.com/mockoon/mockoon/security/advisories/GHSA-8wqc-v2q8-vff2)\n- [Mockoon Fix Commit b42bdfb7f82e83f0e81bea8e6fe41adf5ec82585](https://github.com/mockoon/mockoon/commit/b42bdfb7f82e83f0e81bea8e6fe41adf5ec82585)\n- [Mockoon Pull Request 2255](https://github.com/mockoon/mockoon/pull/2255)\n- [Mockoon Release Tag v9.7.0](https://github.com/mockoon/mockoon/releases/tag/v9.7.0)\n- [Mockoon v9.7.0 Official Release Notes](https://mockoon.com/releases/9.7.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59149) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-12T01:32:31.082868Z"}