MEDIUM 6.5 GitHub
CVE-2026-59149
@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
## Summary
A `FILE` response whose `filePath` embeds request data (e.g. `"/srv/public/{{queryParam 'name'}}"`, the documented way to let the client pick a file) is confined by `getSafeFilePath` with `resolvedPath.startsWith(staticBaseDir)`. That prefix test has no path-separator boundary, so a `../`-escaped path whose absolute form string-prefixes the base directory passes. An unauthenticated client reads files from sibling paths outside the served directory.
## Details
`packages/commons-serv
Affected Products
- npm/@mockoon/commons-server <= 9.6.1
- npm/@mockoon/cli <= 9.6.1
References
- https://github.com/advisories/GHSA-8wqc-v2q8-vff2
- https://github.com/mockoon/mockoon/security/advisories/GHSA-8wqc-v2q8-vff2
- https://nvd.nist.gov/vuln/detail/CVE-2026-59149
- https://github.com/mockoon/mockoon/pull/2255
This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-09-11 via GitHub. Affected: npm/@mockoon/commons-server <= 9.6.1, npm/@mockoon/cli <= 9.6.1.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.