Mockoon allows an attacker to include a filePath in a FILE response that that the resolved path starts with the static base directory, but it does not enforce a path‑separator boundary. As a result a constructed path containing ../ segments can resolve to a file An unauthenticated client can then retrieve that file through HTTP sendFile, WebSocket, or callback handlers, exposing configuration, logs or other sensitive files. The vulnerability does not provide code execution or privilege escalation, but it does compromise the confidentiality of arbitrary files within sibling directories.

The flaw exists in all Mockoon installations that use templatized filePath responses prior to version 9.7.0. All servers running Mockoon 9.6 and earlier are affected regardless of operating system.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score of <1% indicates a very low exploitation probability, but because the flaw allows unauthenticated remote access to arbitrary files, it remains a concern for exposed services. The vulnerability is not listed in CISA KEV and no public exploit has been documented. The likely attack vector is remote over the normal HTTP or WebSocket ports that Mockoon exposes.