Mockoon < 9.2.0 - Path Traversal

Mockoon before 9.2.0 contains a path traversal and local file inclusion caused by unsafe templating of server filenames from user input, letting attackers read arbitrary files on the mock server filesystem, exploit requires crafted request. id: CVE-2025-59049 info: name: Mockoon 9.2.0 - Path...

@mockoon/cli (>=9.0.0, <=9.6.1), @mockoon/serverless (>=9.0.0, <=9.6.1) +2 more potentially affected by CVE-2026-59148 via @mockoon/commons-server (>=9.0.0, <=9.6.1)

@mockoon/commons-server NPM version =9.0.0, =9.0.0, =9.0.0, =0.0.1, =0.30.0, =0.40.0 Source cves: CVE-2026-59148 Source advisory: OSV:GHSA-RQX4-3F6Q-3X2V...

GHSA-RQX4-3F6Q-3X2V @Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Summary Mockoon's admin API commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime commons-server, CLI, serverless, serves Access-Control-Allow-Origin: on every endpoint with all HTTP methods...

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Summary Mockoon's admin API commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime commons-server, CLI, serverless, serves Access-Control-Allow-Origin: on every endpoint with all HTTP methods...

EUVD-2026-42684

@Mockoon/commons-server: Path traversal in templated filePath lets a request escape the served directory prefix-only base check...

@mockoon/cli (>=9.0.0, <=9.6.1), @mockoon/serverless (>=9.0.0, <=9.6.1) +2 more potentially affected by CVE-2026-59149 via @mockoon/commons-server (>=9.0.0, <=9.6.1)

@mockoon/commons-server NPM version =9.0.0, =9.0.0, =9.0.0, =0.0.1, =0.30.0, =0.40.0 Source cves: CVE-2026-59149 Source advisory: OSV:GHSA-8WQC-V2Q8-VFF2...

GHSA-8WQC-V2Q8-VFF2 @Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

Summary A FILE response whose filePath embeds request data e.g. "/srv/public/queryParam 'name'", the documented way to let the client pick a file is confined by getSafeFilePath with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a ../-escaped path whose...

@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

Summary A FILE response whose filePath embeds request data e.g. "/srv/public/queryParam 'name'", the documented way to let the client pick a file is confined by getSafeFilePath with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a ../-escaped path whose...

Missing Authentication for Critical Function

Overview @mockoon/cli is a Mockoon's CLI. Deploy your mock APIs anywhere. Affected versions of this package are vulnerable to Missing Authentication for Critical Function in admin-api.ts, which mounts the admin API on the same listener as user-defined mock routes enabled by default via...

@mockoon/cli (>=9.0.0, <=9.6.1), @mockoon/cloud (>=9.0.0, <=9.6.1) +4 more potentially affected by CVE-2026-59148 via @mockoon/commons (>=9.0.0, <=9.6.1)

@mockoon/commons NPM version =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =0.0.1, =0.30.0, =0.40.0 Source cves: CVE-2026-59148 Source advisory: SNYK:JS-MOCKOONCOMMONS-17957233...

Missing Authentication for Critical Function

Overview @mockoon/commons-server is a Mockoon's commons server library. Used in Mockoon desktop application and CLI. Affected versions of this package are vulnerable to Missing Authentication for Critical Function in admin-api.ts, which mounts the admin API on the same listener as user-defined mo...

@mockoon/cli (>=9.0.0, <=9.6.1), @mockoon/serverless (>=9.0.0, <=9.6.1) +2 more potentially affected by CVE-2026-59148 via @mockoon/commons-server (>=9.0.0, <=9.6.1)

@mockoon/commons-server NPM version =9.0.0, =9.0.0, =9.0.0, =0.0.1, =0.30.0, =0.40.0 Source cves: CVE-2026-59148 Source advisory: SNYK:JS-MOCKOONCOMMONSSERVER-17957231...

@mockoon/cli (>=9.0.0, <=9.6.1), @mockoon/serverless (>=9.0.0, <=9.6.1) +2 more potentially affected by CVE-2026-59149 via @mockoon/commons-server (>=9.0.0, <=9.6.1)

@mockoon/commons-server NPM version =9.0.0, =9.0.0, =9.0.0, =0.0.1, =0.30.0, =0.40.0 Source cves: CVE-2026-59149 Source advisory: SNYK:JS-MOCKOONCOMMONSSERVER-17954402...

CVE-2026-59148

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: with write methods...

CVE-2026-59149

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a...

CVE-2026-59149

Mockoon before version 9.7.0 is affected by a path-traversal in the templated filePath. The vulnerability arises because getSafeFilePath checks resolvedPath.startsWith(staticBaseDir) without a path-separator boundary, allowing an unauthenticated client to craft a ../-escaped path that prefixes th...

CVE-2026-59149 Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a...

CVE-2026-59149

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a...

CVE-2026-59149 Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a...

CVE-2026-59148 Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: with write methods...