CVE-2025-27098
Last modified
CVE-2025-27098 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in the static file handler allows any client to access the files in the server's file system. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in the static file handler allows any client to access the files in the server's file system. When `staticFiles` is set in the `serve` settings in the configuration file, the following handler doesn't check if `absolutePath` is still under the directory provided as `staticFiles`. Users have two options to fix vulnerability; 1. Update `@graphql-mesh/cli` to a version higher than `0.82.21`, and if you use `@graphql-mesh/http`, update it to a version higher than `0.3.18` 2. Remove `staticFiles` option from the configuration, and use other solutions to serve static files.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| The-Guild | Graphql Mesh Cli | >= 0.78.0, < 0.82.22 |
| The-Guild | Graphql Mesh Http | < 0.3.19 |
References
- https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-j2wh-wrv3-4x4gExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-27098?
How severe is CVE-2025-27098?
How do I fix CVE-2025-27098?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-27092GHOSTS is an open source user simulation framework for cyber…7.5
- CVE-2025-27093Sliver is a command and control framework that uses a custom…6.3
- CVE-2025-27094Tuleap is an open-source suite designed to improve software …5.4
- CVE-2025-27095JumpServer is an open source bastion host and an operation a…4.3
- CVE-2025-27096WeGIA is a Web Manager for Institutions with a focus on Port…9.8
- CVE-2025-27097GraphQL Mesh is a GraphQL Federation framework and gateway f…7.5
- CVE-2025-27099Tuleap is an Open Source Suite to improve management of soft…4.8
- CVE-2025-2710A vulnerability was found in Yonyou UFIDA ERP-NC 5.0 and cla…6.1
- CVE-2025-27100lakeFS is an open-source tool that transforms your object st…6.5
- CVE-2025-27101Opal is OBiBa’s core database application for biobanks or ep…7.3
- CVE-2025-27102Agate is central authentication server software for OBiBa ep…5.4
- CVE-2025-27103DataEase is an open source business intelligence and data vi…6.5
Are you affected by CVE-2025-27098?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST