CVE-2025-27098
📋 TL;DR
GraphQL Mesh has a path traversal vulnerability in its static file handler that allows attackers to access arbitrary files on the server filesystem. This affects all GraphQL Mesh deployments using the staticFiles configuration option. Attackers can potentially read sensitive configuration files, source code, or other system files.
💻 Affected Systems
- @graphql-mesh/cli
- @graphql-mesh/http
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive files like SSH keys, database credentials, or configuration secrets leading to further system access.
Likely Case
Information disclosure of application source code, configuration files, or other sensitive data stored on the server filesystem.
If Mitigated
Limited impact with proper network segmentation and minimal sensitive data on accessible filesystems.
🎯 Exploit Status
Simple path traversal attack requiring only HTTP requests to GraphQL Mesh endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: @graphql-mesh/cli > 0.82.21, @graphql-mesh/http > 0.3.18
Vendor Advisory: https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-j2wh-wrv3-4x4g
Restart Required: Yes
Instructions:
1. Update @graphql-mesh/cli: npm update @graphql-mesh/cli
2. Update @graphql-mesh/http: npm update @graphql-mesh/http
3. Restart GraphQL Mesh service
🔧 Temporary Workarounds
Remove staticFiles configuration
allDisable vulnerable static file handler by removing staticFiles option from configuration
Edit GraphQL Mesh config file and remove or comment out staticFiles setting
🧯 If You Can't Patch
- Implement network-level restrictions to limit access to GraphQL Mesh endpoints
- Use reverse proxy with strict path validation before requests reach GraphQL Mesh
🔍 How to Verify
Check if Vulnerable:
Check if staticFiles is configured in GraphQL Mesh config and version is vulnerableCheck Version:
npm list @graphql-mesh/cli @graphql-mesh/httpVerify Fix Applied:
Confirm package versions are above patched versions and test path traversal attempts📡 Detection & Monitoring
Log Indicators:
- Unusual file path patterns in GraphQL Mesh access logs
- Requests for known sensitive files like /etc/passwd, .env, config files
Network Indicators:
- HTTP requests with path traversal sequences (../) to GraphQL Mesh endpoints
SIEM Query:
source="graphql-mesh" AND (url="*../*" OR url="*/etc/*" OR url="*/.env*")