CVE-2025-59049: Mockoon has a Path Traversal and LFI in the static file serving endpoint
(updated )
A mock API configuration for static file serving following the same approach presented in the documentation page, where the server filename is generated via templating features from user input is vulnerable to Path Traversal and LFI, allowing an attacker to get any file in the mock server filesystem. The issue may be particularly relevant in cloud hosted server instances
References
- github.com/advisories/GHSA-w7f9-wqc4-3wxr
- github.com/mockoon/mockoon
- github.com/mockoon/mockoon/blob/1ed31c4059d7f757f6cb2a43e10dc81b0d9c55a9/packages/commons-server/src/libs/server/server.ts
- github.com/mockoon/mockoon/blob/1ed31c4059d7f757f6cb2a43e10dc81b0d9c55a9/packages/commons-server/src/libs/server/server.ts
- github.com/mockoon/mockoon/commit/c7f6e23e87dc3b8cc44e5802af046200a797bd2e
- github.com/mockoon/mockoon/security/advisories/GHSA-w7f9-wqc4-3wxr
- nvd.nist.gov/vuln/detail/CVE-2025-59049
Code Behaviors & Features
Detect and mitigate CVE-2025-59049 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →