CVE-2026-59149 in Mockoon
要約
〜によって VulDB • 2026年07月10日
Mockoon provides a way to design and run mock APIs. Prior to version 9.7.0, a FILE response whose filePath embeds request data was confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWith(staticBaseDir). That prefix test has no path-separator boundary, so a ../-escaped path whose absolute form string-prefixes the base directory passes, allowing an unauthenticated client to read files from sibling paths outside the served directory through HTTP sendFile, WebSocket, or callbacks. This issue is fixed in version 9.7.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.