Is CVE-2026-59149 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59149 being exploited in the wild.

How severe is CVE-2026-59149?

Medium severity, with a CVSS score of 6.5, published 9 July 2026.

Which products and versions are affected?

Mockoon @Mockoon/Commons-Server <= 9.6.1; Mockoon CLI <= 9.6.1; @mockoon/cli (npm) SEMVER:introduced=0,fixed=9.7.0; @mockoon/commons-server (npm) SEMVER:introduced=0,fixed=9.7.0.

Is there a fix for CVE-2026-59149?

Yes. @mockoon/cli (npm): upgrade to 9.7.0 or later; @mockoon/commons-server (npm): upgrade to 9.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59149 attacked?

It is attacked over the network.

Am I affected by CVE-2026-59149?

Check whether you run Mockoon @Mockoon/Commons-Server, Mockoon Commons-Server, Mockoon CLI or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59149: Mockoon path traversal in templated filePath response

Q: Is there a fix for CVE-2026-59149?

Yes. @mockoon/cli (npm): upgrade to 9.7.0 or later; @mockoon/commons-server (npm): upgrade to 9.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-59149 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-59149?

Check whether you run Mockoon @Mockoon/Commons-Server, Mockoon Commons-Server, Mockoon CLI or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59149 · Severity: medium · CVSS 6.5 · Published 2026-07-09

Mockoon is a popular API mocking tool that allows developers to define mock HTTP responses, including serving files. When configured to let users specify filenames via query parameters or URL paths, the application fails to properly validate file paths. An attacker can use path traversal sequences (like `../`) to read arbitrary files from sibling directories outside the intended served directory, potentially exposing sensitive configuration files, environment variables, or customer data.

Technologies: Mockoon @Mockoon/Commons-Server. Vendors: Mockoon, npm.

Quick answers

Is CVE-2026-59149 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59149 being exploited in the wild.
How severe is CVE-2026-59149?: Medium severity, with a CVSS score of 6.5, published 9 July 2026.
Which products and versions are affected?: Mockoon @Mockoon/Commons-Server <= 9.6.1; Mockoon CLI <= 9.6.1; @mockoon/cli (npm) SEMVER:introduced=0,fixed=9.7.0; @mockoon/commons-server (npm) SEMVER:introduced=0,fixed=9.7.0.
Is there a fix for CVE-2026-59149?: Yes. @mockoon/cli (npm): upgrade to 9.7.0 or later; @mockoon/commons-server (npm): upgrade to 9.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59149 attacked?: It is attacked over the network.
Am I affected by CVE-2026-59149?: Check whether you run Mockoon @Mockoon/Commons-Server, Mockoon Commons-Server, Mockoon CLI or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@mockoon/cli (npm): upgrade to 9.7.0 or later
```
npm install @mockoon/cli@9.7.0
```
@mockoon/commons-server (npm): upgrade to 9.7.0 or later
```
npm install @mockoon/commons-server@9.7.0
```

Technical details

The vulnerability exists in `packages/commons-server/src/libs/server/server.ts` in the `getSafeFilePath` function (line 2315+). When a FILE response is configured with a templated filePath like `/srv/public/{{queryParam 'name'}}`, the function parses request-controlled parameters via TemplateParser and validates the resolved path using `resolvedPath.startsWith(staticBaseDir)`. This check lacks path-separator boundaries—for example, `/srv/public_backup/.env` string-prefixes `/srv/public` and passes validation, even though it lies outside the intended `/srv/public/` directory. The vulnerability affects HTTP sendFile, WebSocket file delivery, and callback responses. An unauthenticated attacker can read arbitrary files by supplying malicious filePath parameters. The patch (version 9.7.0) corrects the boundary check by appending a path separator or using proper relative-path validation.

Affected products

Mockoon @mockoon/commons-server <= 9.6.1
Mockoon @mockoon/cli <= 9.6.1

Identifiers

CVE-2026-59149
GHSA-8wqc-v2q8-vff2

Timeline

2026-06-22: disclosed: Initially published by GitHub Advisory Database
2026-06-22: patched: Fix released in version 9.7.0
2026-09-11: advisory: GHSA-8wqc-v2q8-vff2 and CVE-2026-59149 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.