Executive brief
GraphQL Mesh is a framework for building GraphQL APIs. When the staticFiles feature is enabled, an insufficient path validation check allows unauthenticated remote attackers to read arbitrary files from the server's filesystem via path traversal techniques. An attacker can access sensitive application files (e.g., package.json, configuration files, or system files like /etc/passwd) without proper authorization.
Technical details
This is a path traversal vulnerability (CWE-22) in the staticFiles HTTP handler of GraphQL Mesh. The vulnerable code constructs an absolute file path by joining the base directory, staticFiles path, and user-supplied relativePath parameter, but uses an insufficient check (absolutePath.includes(staticFiles)) that can be bypassed with URL-encoded path traversal sequences (e.g., /..%2f). The check does not verify that the resolved path remains within the intended directory boundary. Attack vector is network-based with high complexity (user interaction/specific URL crafting required) and no authentication needed. Successful exploitation allows reading arbitrary filesystem contents. Patches are available: @graphql-mesh/cli versions 0.82.22+, and @graphql-mesh/http versions 0.3.19+.
Affected products
- The Guild @graphql-mesh/cli 0.78.0 to 0.82.21
- The Guild @graphql-mesh/http all versions before 0.3.19
Timeline
- 2023-02-16: disclosed
- 2023-02-16: patched: @graphql-mesh/cli 0.82.22 and @graphql-mesh/http 0.3.19 released
- 2025-02-20: other: CVE-2025-27098 assigned