CVE-2025-27098

Summary

CVE-2025-27098 is a vulnerability affecting GraphQL Mesh, a GraphQL Federation framework and gateway. The issue lies in the static file handler's missing access checks, allowing any client to access files on the server's file system when the `staticFiles` setting is enabled in the configuration file. If `absolutePath` is not properly checked against the `staticFiles` directory, an attacker can potentially access unintended files. To mitigate this vulnerability, users can either update `@graphql-mesh/cli` and `@graphql-mesh/http` to versions higher than `0.82.21` and `0.3.18`, respectively, or remove the `staticFiles` option from the configuration and employ alternative methods for serving static files.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.