Vulnerability · Published Jul 23, 2026 · Assigned by VulnCheck

CVE-2026-65919Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload

High 7.5

In plain English

A high-severity path traversal in meshery from meshery. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)2.1%top 18.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.

Affected products (as reported)

Vendor	Product	Versions
meshery	meshery	0 – before 1.0.57

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Researcher Disclosure (1) technical-description, issue-tracking
Researcher Disclosure (2) patch, issue-tracking, technical-description
Meshery 1.0.57 Release Notes release-notes, patch
Pull Request issue-tracking, patch
Patch Commit patch
https://www.vulncheck.com/advisories/meshery-unauthenticated-arbitrary-file-read-via-fileview-and-filedownload third-party-advisory