Meshery <1.0.57 - Arbitrary File Read
CVE-2026-65919
Verified
Description
Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.
Severity
High
CVSS Score
7.5
Exploit Probability
2%
Affected Product
meshery
Published Date
August 7, 2026
Template Author
str4k3r
CVE-2026-65919.yaml
7.5Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-65919
CWE ID:
cwe-22
References
https://github.com/meshery/meshery/issues/20076https://github.com/meshery/meshery/pull/20133https://github.com/meshery/meshery/commit/ea83a26cb090b13be36c07cf24a99f8c637cc765https://www.vulncheck.com/advisories/meshery-unauthenticated-arbitrary-file-read-via-fileview-and-filedownloadhttps://nvd.nist.gov/vuln/detail/CVE-2026-65919
Remediation Steps
Upgrade to version 1.0.57 or later.