CVE-2026-65919highCWE-22

CVE-2026-65919: falha de alta gravidade em meshery

Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar meshery

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

36Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 8.7epss 2.1%
Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
meshery · meshery
CVEs relacionadas — meshery

No mesmo produto, das mais perigosas para as menos.

CVE-2024-35181MEDIUMGHSL-2024-013 Meshery SQL Injection vulnerabilityEPSS 1.6%CVE-2024-35182MEDIUMGHSL-2024-014 Meshery SQL Injection vulnerabilityEPSS 1.6%CVE-2024-29031HIGHMeshery SQL Injection vulnerabilityEPSS 1.0%