CVE-2026-59149

Name of the Vulnerable Software and Affected Versions Mockoon versions prior to 9.7.0

Description An issue exists in the way FILE responses handle filePath when embedding request data. The getSafeFilePath function in packages/commons-server/src/libs/server/server.ts uses a prefix test resolvedPath.startsWith(staticBaseDir) that lacks a path-separator boundary. This allows an unauthenticated client to use ../ sequences to escape the intended directory and read files from sibling paths via HTTP sendFile, WebSocket, or callbacks.

Recommendations Update to version 9.7.0.