CVE-2026-59149: Path Traversal Vulnerability in @Mockoon/commons-server and @Mockoon/cli
Summary
CVE-2026-59149: A FILE response whose filePath embeds request data (e.g. Affects @mockoon/commons-server versions < 9.7.0. Fixed in 9.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @Mockoon/commons-server and @Mockoon/cli packages are widely used tools for creating mock APIs and simulating server responses. They allow developers to easily set up and manage mock servers for testing purposes. However, a critical vulnerability has been identified that can lead to unauthorized file access, compromising the security of applications utilizing these packages.
Vulnerability Detail
The vulnerability arises from a path traversal issue in the templated 'filePath' parameter, which allows an unauthenticated client to manipulate the request and access files outside the intended directory. The function 'getSafeFilePath' performs a prefix-only check, which fails to account for path separators. As a result, a request like 'name=../public_backup/.env' can resolve to an absolute path that is outside the served directory, leading to potential exposure of sensitive files.
How To Fix
Latest published version: 9.9.0 as of 22 Oct 2026
npm install @mockoon/commons-server@9.9.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.7.0
This is the first release that contains the fix.
npm install @mockoon/commons-server@9.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using user-controlled input in the 'filePath' parameter until the package is updated. Ensure that any file paths are strictly validated and do not allow for traversal sequences like '../'.
Conclusion
The path traversal vulnerability in @Mockoon/commons-server and @Mockoon/cli poses a significant risk to applications that utilize these packages. It is crucial to update to the patched version to mitigate this risk. Additionally, implementing strict input validation can help prevent exploitation until an update can be applied.
See every vulnerability recorded for @mockoon/commons-server →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory. This can lead to unauthorized access to sensitive information.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your package-lock.json file, you can identify if your application is affected. You can also use the Vulert playground at Vulert Scanner without signing up.
If exploited, this vulnerability could allow attackers to read sensitive files, such as environment variables or configuration files, leading to data breaches or further attacks on the application.
Yes, the CVSS score for this vulnerability is 6.5, indicating a moderate level of severity.
If you cannot update the package right away, implement strict input validation for the 'filePath' parameter to prevent path traversal attacks and monitor your application for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for @mockoon/commons-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
