PT-2026-64044 · Meshery · Meshery

George Chen · CVE-2026-65919 · Publicado 2026-07-23 · Atualizado 2026-07-23

Mitre

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-65919

Produtos afetados

Meshery

Referências · 6

• https://github.com/meshery/meshery/pull/20133 · Nota
• https://github.com/meshery/meshery/issues/20076 · Nota
• https://github.com/meshery/meshery/commit/ea83a26cb090b13be36c07cf24a99f8c637cc765 · Correção
• https://github.com/meshery/meshery/releases/tag/v1.0.57 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-65919 · Nota de Segurança
• https://vulncheck.com/advisories/meshery-unauthenticated-arbitrary-file-read-via-fileview-and-filedownload · Nota