DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-59149: CVE-2026-59149: Sibling Directory Path Traversal in Mockoon Backend Server

#security #cve #cybersecurity

CVE-2026-59149: Sibling Directory Path Traversal in Mockoon Backend Server

Vulnerability ID: CVE-2026-59149
CVSS Score: 6.5
Published: 2026-09-11

CVE-2026-59149 identifies a directory traversal vulnerability in @mockoon/commons-server, the backend mock-server library powering the Mockoon application. The flaw occurs in the path containment validation logic used during raw file response generation. An unauthenticated attacker can exploit this weakness to retrieve arbitrary files from sibling directories sharing a common prefix with the designated static base directory.

TL;DR

A path traversal vulnerability in Mockoon's backend server allows unauthenticated clients to read files from sibling directories outside the configured base directory by exploiting character-by-character prefix validation.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22
  • Attack Vector: Network
  • CVSS v3.1 Score: 6.5
  • EPSS Score: 0.00483 (0.48%)
  • Impact: Confidentiality (High)
  • Exploit Status: Proof of Concept / Public Details Available
  • KEV Status: Not Listed

Affected Systems

  • Mockoon Desktop Application
  • Mockoon CLI
  • @mockoon/commons-server npm package
  • mockoon: < 9.7.0 (Fixed in: 9.7.0)
  • @mockoon/commons-server: < 9.7.0 (Fixed in: 9.7.0)

Mitigation Strategies

  • Upgrade Mockoon applications and server components to version 9.7.0 or later.
  • Sanitize client input before processing template variables in file-serving endpoints.
  • Configure Mockoon execution environments to operate under the principle of least privilege.

Remediation Steps:

  1. Run the command npm install @mockoon/commons-server@latest or update the parent application package configurations.
  2. Verify that path resolution checks execute using semantic relative path checking rather than string-prefix matching.
  3. Isolate Mockoon containers from sibling workspace environments.

References

Read the full report for CVE-2026-59149 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)