---
id: CVE-2026-65919
title: >-
  Meshery before 1.0.57 contains an unauthenticated arbitrary file read
  vulnerability in the /api/system/fileView and /api/system/fileDownload
  endpoints that pass user-supplied file parameters directly to os.Open without
  path validation
summary: >-
  Meshery before 1.0.57 contains an unauthenticated arbitrary file read
  vulnerability in the /api/system/fileView and /api/system/fileDownload
  endpoints that pass user-supplied file parameters directly to os.Open without
  path validation. A…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
vendor: meshery
product: meshery
affected:
  - meshery < 1.0.57
published: '2026-07-23'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T19:17:38.640'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-65919'
references:
  - url: >-
      https://github.com/meshery/meshery/commit/ea83a26cb090b13be36c07cf24a99f8c637cc765
    label: disclosure@vulncheck.com
  - url: 'https://github.com/meshery/meshery/issues/18375'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/meshery/meshery/issues/20076'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/meshery/meshery/pull/20133'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/meshery/meshery/releases/tag/v1.0.57'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/meshery-unauthenticated-arbitrary-file-read-via-fileview-and-filedownload
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-07-24T22:04:13.522864Z'
epss: 0.02087
epssPercentile: 0.8082
exploits:
  nuclei:
    - CVE-2026-65919
  checkedAt: '2026-09-27T10:33:55.974Z'
exploitAvailable: true
ingestedAt: '2026-09-14T20:14:21.115Z'
---

## Overview

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.