CVE-2025-59049

HIGH NUCLEI

Mockoon < 9.2.0 - Path Traversal and Local File Inclusion via Static File Serving Configuration

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2025-59049 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same approach presented in the documentation page, where the server filename is generated via templating features from user input is vulnerable to Path Traversal and LFI, allowing an attacker to get any file in the mock server filesystem. The issue may be particularly relevant in cloud hosted server instances. Version 9.2.0 fixes the issue.

Nuclei Templates (1)

Mockoon < 9.2.0 - Path Traversal
HIGHVERIFIEDby iamnoooob,rootxharsh,pdresearch

References (4)

Core 4

Scores

CVSS v3 7.5
EPSS 0.0191
EPSS Percentile 83.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-22 CWE-24 CWE-73
Status published
Products (3)
mockoon/cli 0 - 9.2.0npm
mockoon/commons-server 0 - 9.2.0npm
mockoon/mockoon < 9.2.0
Published Sep 10, 2025
Tracked Since Feb 18, 2026