Vulnerability Description
GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in the static file handler allows any client to access the files in the server's file system. When `staticFiles` is set in the `serve` settings in the configuration file, the following handler doesn't check if `absolutePath` is still under the directory provided as `staticFiles`. Users have two options to fix vulnerability; 1. Update `@graphql-mesh/cli` to a version higher than `0.82.21`, and if you use `@graphql-mesh/http`, update it to a version higher than `0.3.18` 2. Remove `staticFiles` option from the configuration, and use other solutions to serve static files.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| The-Guild | Graphql Mesh Cli | >= 0.78.0, < 0.82.22 |
| The-Guild | Graphql Mesh Http | < 0.3.19 |
Related Weaknesses (CWE)
References
- https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-j2wh-wrv3-4x4gExploitVendor Advisory
FAQ
What is CVE-2025-27098?
CVE-2025-27098 is a vulnerability with a CVSS score of 5.8 (MEDIUM). GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as Mon...
How severe is CVE-2025-27098?
CVE-2025-27098 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-27098?
Check the references section above for vendor advisories and patch information. Affected products include: The-Guild Graphql Mesh Cli, The-Guild Graphql Mesh Http.