{"action":"Upgrade @mockoon/commons-server to 9.2.0 or later.","affected":[{"fixed":"9.2.0","introduced":"0"}],"component":"@mockoon/commons-server","cve_ids":["CVE-2025-59049"],"ecosystem":"npm","epss":0.01764,"exploited":false,"fixed_versions":["9.2.0"],"ghsa_id":"GHSA-w7f9-wqc4-3wxr","id":"tcs_01M5KGE9EG9P6HYSKQK6MTM4K4","modified_at":"2025-09-13T03:03:19Z","published_at":"2025-03-11T16:17:42Z","references":["https://osv.dev/vulnerability/GHSA-w7f9-wqc4-3wxr","https://github.com/mockoon/mockoon/security/advisories/GHSA-w7f9-wqc4-3wxr","https://nvd.nist.gov/vuln/detail/CVE-2025-59049","https://github.com/mockoon/mockoon/commit/c7f6e23e87dc3b8cc44e5802af046200a797bd2e","https://github.com/mockoon/mockoon","https://github.com/mockoon/mockoon/blob/1ed31c4059d7f757f6cb2a43e10dc81b0d9c55a9/packages/commons-server/src/libs/server/server.ts#L1400","https://github.com/mockoon/mockoon/blob/1ed31c4059d7f757f6cb2a43e10dc81b0d9c55a9/packages/commons-server/src/libs/server/server.ts#L1551"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-w7f9-wqc4-3wxr","url":"https://osv.dev/vulnerability/GHSA-w7f9-wqc4-3wxr"}],"summary":"Mockoon has a Path Traversal and LFI in the static file serving endpoint"}