The vulnerability exists in the getSafeFilePath function of @mockoon/commons-server where the static base directory is checked using a string prefix match (resolvedPath.startsWith(staticBaseDir)) without ensuring a path separator boundary. This allows a crafted filePath containing '../' sequences to escape the intended directory and access files in sibling directories whose absolute paths start with the base directory string. The filePath is request-controlled via templating, affecting all FILE response types. The issue is confirmed in versions before 9.7.0. A proof-of-concept demonstrates reading sensitive files outside the served directory.

An unauthenticated attacker can read arbitrary files on the server outside the intended served directory, potentially exposing sensitive information. The vulnerability does not allow modification or deletion of files, only read access. The CVSS score is 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact.

A patch is available for this vulnerability. Users should upgrade @mockoon/commons-server to version 9.7.0 or later where the path traversal issue is fixed by properly validating file paths with path separator boundaries. Until patched, avoid using request-controlled data in filePath templates or implement additional path validation to prevent directory traversal.