CVE-2026-65919

Name of the Vulnerable Software and Affected Versions Meshery versions prior to 1.0.57

Description An unauthenticated arbitrary file read issue exists in the '/api/system/fileView' and '/api/system/fileDownload' endpoints. The system passes user-supplied file parameters directly to the os.Open() function without performing path validation. This allows attackers to use absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.

Recommendations Update to version 1.0.57 or later. As a temporary mitigation, restrict access to the '/api/system/fileView' and '/api/system/fileDownload' endpoints.