PT-2025-37089 · Mockoon · Mockoon

Risingzero · Published 2025-03-11 · Updated 2025-10-08 · CVE-2025-59049

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Mockoon versions prior to 9.2.0

Description: Mockoon is a tool used to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving generates the server filename from user input, which is vulnerable to Path Traversal and Local File Inclusion (LFI). This allows an attacker to access any file within the mock server filesystem. The issue may be particularly relevant in cloud-hosted server instances.

Recommendations: Update to version 9.2.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-73

CWE-22

CWE-24

Related Identifiers

CVE-2025-59049

GHSA-W7F9-WQC4-3WXR

Affected Products

Mockoon

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59049.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-59049 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59049 · Security Note
• https://osv.dev/vulnerability/GHSA-w7f9-wqc4-3wxr · Vendor Advisory
• https://github.com/mockoon/mockoon/security/advisories/GHSA-w7f9-wqc4-3wxr · Note
• https://github.com/mockoon/mockoon/blob/1ed31c4059d7f757f6cb2a43e10dc81b0d9c55a9/packages/commons-server/src/libs/server/server.ts#L1400 · Note
• https://github.com/mockoon/mockoon/commit/c7f6e23e87dc3b8cc44e5802af046200a797bd2e · Note
• https://github.com/mockoon/mockoon/blob/1ed31c4059d7f757f6cb2a43e10dc81b0d9c55a9/packages/commons-server/src/libs/server/server.ts#L1551 · Note
• https://github.com/mockoon/mockoon · Note
• https://twitter.com/VulmonFeeds/status/1965906886093328600 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1976044980545183960 · Twitter Post
• https://twitter.com/CVEnew/status/1965920219102089319 · Twitter Post