https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 20:00:30 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-335476 EUVD-2026-335476 https://cve.radiocsirt.org/vuln/euvd-2026-335476 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59149 <p>Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWith(staticBaseDir). That prefix test has no path-separator boundary, so a ../-escaped path whose absolute form string-prefixes the base directory passes, allowing an unauthenticated client to read files from sibling paths outside the served directory through HTTP sendFile, WebSocket, or callbacks. This issue is fixed in version 9.7.0.</p> <p>Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWith(staticBaseDir). That prefix test has no path-separator boundary, so a ../-escaped path whose absolute form string-prefixes the base directory passes, allowing an unauthenticated client to read files from sibling paths outside the served directory through HTTP sendFile, WebSocket, or callbacks. This issue is fixed in version 9.7.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-59149 https://cve.radiocsirt.org/vuln/ghsa-8wqc-v2q8-vff2 <p><strong>Affected:</strong> npm: @mockoon/commons-server, npm: @mockoon/cli</p> <p>## Summary</p> <p>A `FILE` response whose `filePath` embeds request data (e.g. `&#34;/srv/public/{{queryParam &#39;name&#39;}}&#34;`, the documented way to let the client pick a file) is confined by `getSafeFilePath` with `resolvedPath.startsWith(staticBaseDir)`. That prefix test has no path-separator boundary, so a `../`-escaped path whose absolute form string-prefixes the base directory passes. An unauthenticated client reads files from sibling paths outside the served directory.</p> <p>## Details</p> <p>`packages/commons-server/src/libs/server/server.ts`, `getSafeFilePath` (line 2315). The static base is the text before the first `{{`, resolved to an absolute path; the parsed `filePath` is then bounded by a string-prefix check:</p> <p>```ts const staticBaseDir = staticBaseMatch ? resolve(staticBaseMatch[1]) : null; // 2336 const parsedFilePath = TemplateParser({ ... request ... }); // request-controlled const resolvedPath = resolvePath(parsedFilePath);</p> <p>if (isPathAbsolute) { if (!staticBaseDir || !resolvedPath.startsWith(staticBaseDir)) { // 2355 throw new Error(`Access to absolute path outside of the original static base directory (${resolvedPath})`); } } else if (!resolvedPath.startsWith(this.options.environmentDirectory)) { // 2362 throw new Error(`Access to relative path outside of the environment base directory (${resolvedPath})`); } ```</p> <p>With `&#34;/srv/public/{{queryParam &#39;name&#39;}}&#34;`, `staticBaseDir = /srv/public`. A request `name=../public_backup/.env` res…</p> <p><strong>Affected:</strong> npm: @mockoon/commons-server, npm: @mockoon/cli</p> <p>## Summary</p> <p>A `FILE` response whose `filePath` embeds request data (e.g. `&#34;/srv/public/{{queryParam &#39;name&#39;}}&#34;`, the documented way to let the client pick a file) is confined by `getSafeFilePath` with `resolvedPath.startsWith(staticBaseDir)`. That prefix test has no path-separator boundary, so a `../`-escaped path whose absolute form string-prefixes the base directory passes. An unauthenticated client reads files from sibling paths outside the served directory.</p> <p>## Details</p> <p>`packages/commons-server/src/libs/server/server.ts`, `getSafeFilePath` (line 2315). The static base is the text before the first `{{`, resolved to an absolute path; the parsed `filePath` is then bounded by a string-prefix check:</p> <p>```ts const staticBaseDir = staticBaseMatch ? resolve(staticBaseMatch[1]) : null; // 2336 const parsedFilePath = TemplateParser({ ... request ... }); // request-controlled const resolvedPath = resolvePath(parsedFilePath);</p> <p>if (isPathAbsolute) { if (!staticBaseDir || !resolvedPath.startsWith(staticBaseDir)) { // 2355 throw new Error(`Access to absolute path outside of the original static base directory (${resolvedPath})`); } } else if (!resolvedPath.startsWith(this.options.environmentDirectory)) { // 2362 throw new Error(`Access to relative path outside of the environment base directory (${resolvedPath})`); } ```</p> <p>With `&#34;/srv/public/{{queryParam &#39;name&#39;}}&#34;`, `staticBaseDir = /srv/public`. A request `name=../public_backup/.env` res…</p> https://cve.radiocsirt.org/vuln/ghsa-8wqc-v2q8-vff2