CVE-2026-65919highCWE-22

CVE-2026-65919: high-severity vulnerability in meshery

Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload

Published · Updated

Follow this CVE+ Monitor meshery

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

36Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 8.7epss 2.1%
Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
meshery · meshery
Related CVEs — meshery

In the same product, most dangerous first.

CVE-2024-35181MEDIUMGHSL-2024-013 Meshery SQL Injection vulnerabilityEPSS 1.6%CVE-2024-35182MEDIUMGHSL-2024-014 Meshery SQL Injection vulnerabilityEPSS 1.6%CVE-2024-29031HIGHMeshery SQL Injection vulnerabilityEPSS 1.0%