THREAT OPS › Threat News › [GHSA] GHSA-8wqc-v2q8-vff2 (medium) — @Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
[GHSA] GHSA-8wqc-v2q8-vff2 (medium) — @Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
GHSA-8wqc-v2q8-vff2 Severity: medium CVE: CVE-2026-59149
@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
## Summary
A `FILE` response whose `filePath` embeds request data (e.g. `"/srv/public/{{queryParam 'name'}}"`, the documented way to let the client pick a file) is confined by `getSafeFilePath` with `resolved
Indicators of compromise
- CVE-2026-59149cve
- http://127.0.0.1:3000/download?name=url
Original source: https://github.com/advisories/GHSA-8wqc-v2q8-vff2