CVE-2025-59049
Last modified
CVE-2025-59049 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same approach presented in the documentation page, where the server filename is generated via templating features from user input is vulnerable to Path Traversal and LFI, allowing an attacker to get any file in the mock server filesystem. The issue may be particularly relevant in cloud hosted server instances. EPSS estimates a 1.66% chance of exploitation in the next 30 days.
Description
Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same approach presented in the documentation page, where the server filename is generated via templating features from user input is vulnerable to Path Traversal and LFI, allowing an attacker to get any file in the mock server filesystem. The issue may be particularly relevant in cloud hosted server instances. Version 9.2.0 fixes the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-59049?
How severe is CVE-2025-59049?
How do I fix CVE-2025-59049?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-59043OpenBao is an open source identity-based secrets management …7.5
- CVE-2025-59044Himmelblau is an interoperability suite for Microsoft Azure …4.4
- CVE-2025-59045Stalwart is a mail and collaboration server. Starting in ver…7.1
- CVE-2025-59046The npm package `interactive-git-checkout` is an interactive…9.8
- CVE-2025-59047matrix-sdk-base is the base component to build a Matrix clie…2.7
- CVE-2025-59048OpenBao's AWS Plugin generates AWS access credentials based …8.1
- CVE-2025-5905A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It h…8.8
- CVE-2025-59050Greenshot is an open source Windows screenshot utility. Gree…7.8
- CVE-2025-59051The FreePBX Endpoint Manager module includes a Network Scann…8.6
- CVE-2025-59052Angular is a development platform for building mobile and de…7.1
- CVE-2025-59053AIRI is a self-hosted, artificial intelligence based Grok Co…9.6
- CVE-2025-59054dstack is a software development kit (SDK) to simplify the d…8.5
Are you affected by CVE-2025-59049?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST