CyberRota Analysis
AI-GeneratedMockoon versions prior to 9.7.0 are vulnerable to a path traversal attack that allows unauthenticated clients to access files outside the intended directory by exploiting a flaw in the file path validation mechanism. This vulnerability can lead to unauthorized file disclosure, potentially exposing sensitive information. Organizations using affected versions should prioritize upgrading to version 9.7.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWith(staticBaseDir). That prefix test has no path-separator boundary, so a ../-escaped path whose absolute form string-prefixes the base directory passes, allowing an unauthenticated client to read files from sibling paths outside the served directory through HTTP sendFile, WebSocket, or callbacks. This issue is fixed in version 9.7.0.