What’s Vulnerable › Vulnerabilities

CVE-2026-65919: Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-07-23 · updated 2026-09-14
• Weakness: CWE-22

Description

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.

Affected products

• meshery: before 1.0.57 — fixed in 1.0.57

How to fix

Upgrade to a fixed version: meshery 1.0.57. Check the vendor advisory for mitigations.

References

• https://github.com/meshery/meshery/commit/ea83a26cb090b13be36c07cf24a99f8c637cc765
• https://github.com/meshery/meshery/issues/18375
• https://github.com/meshery/meshery/issues/20076
• https://github.com/meshery/meshery/pull/20133
• https://github.com/meshery/meshery/releases/tag/v1.0.57
• https://www.vulncheck.com/advisories/meshery-unauthenticated-arbitrary-file-read-via-fileview-and-filedownload

Get alerted when CVE-2026-65919 or the next vulnerability affects your stack