Mockoon allows a client to supply a templated filePath in a FILE response. The validation routine checks only that the resolved path starts with the configured static base directory, without enforcing a path‑separator boundary. Consequently, a request can include "../" segments that resolve to a file outside the intended directory while still matching the prefix test. An unauthenticated attacker can then retrieve that file through the standard HTTP sendFile, WebSocket, or callback mechanisms, exposing configuration files, logs, or other sensitive data. The flaw does not provide code execution or privilege escalation; it only compromises confidentiality of arbitrary files.

Affected systems: All installations of Mockoon that use a templated filePath response prior to the release of version 9.7.0 are vulnerable. The vulnerability applies to any operating system and any server configuration that exposes the Mockoon mock API, regardless of network placement.

Risk and exploitability: The CVSS score of 6.5 indicates a medium severity issue. The EPSS score of <1% suggests a very low probability of exploitation in the wild, but because the flaw permits unauthenticated remote access to arbitrary files, it remains of concern for exposed services. The vulnerability is not listed in CISA KEV and no public exploit has been documented. The likely attack vector is remote over the normal HTTP or WebSocket ports that Mockoon exposes.