Read the docs
TI-2026-46957 Aliases CVE-2026-65919GHSA-2x9h-mj6j-c376

Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload

Priority MEDIUM 48CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02087 81st percentileScored 2026-11-07
Fix Fixed meshery (meshery): 1.0.57

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mesherymesherybefore 1.0.571.0.57Patch availableCNA
  • meshery Vendormeshery Affected before 1.0.57 Fixed in 1.0.57 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:layer5:meshery:*:*:*:*:*:*:*:*——meshery
  • cpe:2.3:a:layer5:meshery:*:*:*:*:*:*:*:* Versions — — ·meshery

Remediation

  • Fix · CNA meshery (meshery) Fixed in 1.0.57

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-65919
  2. 2026-10-03 Alias added: GHSA-2x9h-mj6j-c376

References

Patch 4

Other 1

  • TI-2024-24304 Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and… CVSS 3.1CRITICAL 9.8
  • TI-2021-11849 A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker… CVSS 3.1CRITICAL 9.8
  • TI-2024-19213 Meshery SQL Injection vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-23256 GHSL-2024-014 Meshery SQL Injection vulnerability CVSS 3.1HIGH 8.1
  • TI-2023-25091 A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a… CVSS 3.1CRITICAL 9.8
  • TI-2024-23255 GHSL-2024-013 Meshery SQL Injection vulnerability CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences