{"id":"CVE-2026-65919","summary":"Meshery \u003c 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload","details":"Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.","modified":"2026-07-28T11:31:20.409981686Z","published":"2026-07-23T17:39:27.501Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65919.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65919.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65919"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/meshery-unauthenticated-arbitrary-file-read-via-fileview-and-filedownload"},{"type":"REPORT","url":"https://github.com/meshery/meshery/issues/20076"},{"type":"FIX","url":"https://github.com/meshery/meshery/commit/ea83a26cb090b13be36c07cf24a99f8c637cc765"},{"type":"FIX","url":"https://github.com/meshery/meshery/pull/20133"},{"type":"FIX","url":"https://github.com/meshery/meshery/releases/tag/v1.0.57"},{"type":"PACKAGE","url":"https://github.com/meshery/meshery"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/meshery/meshery","events":[{"introduced":"0"},{"fixed":"be4206fac418d07abfa0e53ca0e231a64d4a9ab8"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.0.57"}],"source":"AFFECTED_FIELD"}}],"versions":["v1.0.56","v1.0.55","v1.0.54","v1.0.53","v1.0.52","v1.0.51","v1.0.50","v1.0.49","v1.0.48","v1.0.47","v1.0.46","v1.0.45","v1.0.44","v1.0.43","v1.0.42","v1.0.41","v1.0.40","v1.0.39","v1.0.38","v1.0.37","v1.0.36","v1.0.35","v1.0.34","v1.0.33","v1.0.32","v1.0.31","v1.0.30","v1.0.29","v1.0.28","v1.0.27","v1.0.26","v1.0.25","v1.0.24","v1.0.23","v1.0.20","v1.0.19","v1.0.18","v1.0.17","v1.0.16","v1.0.15","v1.0.14","v1.0.12","v1.0.13","v1.0.11","v1.0.10","v1.0.9","v1.0.8","v1.0.7","v1.0.6","v1.0.3","v1.0.5","v1.0.4","v1.0.2","v1.0.1","v0.9.2","v0.9.1","v0.9.0","v1.0.0","v0.8.214","v0.8.213","v0.8.212","v0.8.211","v0.8.210","v0.8.209","v0.8.208","v0.8.207","v0.8.206","v0.8.205","v0.8.204","v0.8.203","v0.8.202","v0.8.201","v0.8.200","v0.8.199","v0.8.198","v0.8.197","v0.8.196","v0.8.195","v0.8.194","v0.8.193","v0.8.192","v0.8.191","v0.8.190","v0.8.189","v0.8.188","v0.8.187","v0.8.186","v0.8.185","v0.8.184","v0.8.183","v0.8.181","v0.8.180","v0.8.179","v0.8.178","v0.8.177","v0.8.167","v0.8.176","v0.8.175","v0.8.174","v0.8.172","v0.8.173","v0.8.171","v0.8.170","v0.8.169","v0.8.168","v0.8.166","v0.8.165","v0.8.164","v0.8.163","v0.8.162","v0.8.161","v0.8.160","v0.8.159","v0.8.158","v0.8.157","v0.8.156","v0.8.155","v0.8.154","v0.8.153","v0.8.152","v0.8.151","v0.8.150","v0.8.149","v0.8.148","v0.8.147","v0.8.146","v0.8.145","v0.8.144","v0.8.143","v0.8.142","v0.8.141","v0.8.140","v0.8.139","v0.8.138","v0.8.137","v0.8.136","v0.8.135","v0.8.134","v0.8.133","v0.8.132","v0.8.131","v0.8.130","v0.8.129","v0.8.128","v0.8.127","v0.8.126","v0.8.125","v0.8.124","v0.8.123","v0.8.122","v0.8.121","v0.8.120","v0.8.119","v0.8.118","v0.8.117","v0.8.116","v0.8.115","v0.8.114","v0.8.113","v0.8.111","v0.8.112","v0.8.110","v0.8.109","v0.8.108","v0.8.107","v0.8.106","v0.8.104","v0.8.105","v0.8.103","v0.8.102","v0.8.101","v0.8.100","v0.8.99","v0.8.98","v0.8.97","v0.8.95","v0.8.96","v0.8.94","v0.8.93","v0.8.92","v0.8.91","v0.8.90","v0.8.89","v0.8.88","v0.8.87","v0.8.86","v0.8.85","v0.8.84","v0.8.83","v0.8.82","v0.8.81","v0.8.80","v0.8.79","v0.8.78","v0.8.77","v0.8.76","v0.8.73","v0.8.75","v0.8.74","v0.8.72","v0.8.71","v0.8.70","v0.8.69","v0.8.68","v0.8.67","v0.8.66","v0.8.65","v0.8.64","v0.8.63","v0.8.62","v0.8.61","v0.8.60","v0.8.59","v0.8.58","v0.8.57","v0.8.56","v0.8.55","v0.8.54","v0.8.53","v0.8.51","v0.8.52","v0.8.50","v0.8.48","v0.8.47","v0.8.46","v0.8.44","v0.8.43","v0.8.42","v0.8.41","v0.8.40","v0.8.39","v0.8.38","v0.8.37","v0.8.36","v0.8.35","v0.8.34","v0.8.33","v0.8.32","v0.8.31","v0.8.30","v0.8.29","v0.8.28","v0.8.27","v0.8.26","v0.8.25","v0.8.24","v0.8.23","v0.8.22","v0.8.21","v0.8.20","v0.8.19","v0.8.18","v0.8.17","v0.8.16","v0.8.15","v0.8.14","v0.8.13","v0.8.12","v0.8.11","v0.8.10","v0.8.9","v0.8.8","v0.8.7","v0.8.6","v0.8.5","v0.8.4","v0.8.3","v0.8.2","v0.8.1","v0.8.0","v0.7.172","v0.7.171","v0.7.170","v0.7.169","v0.7.168","v0.7.167","v0.7.165","v0.7.166","v0.7.164","v0.7.163","v0.7.162","v0.7.161","v0.7.160","v0.7.159","v0.7.158","v0.7.157","v0.7.156","v0.7.155","v0.7.154","v0.7.153","v0.7.152","v0.7.147","v0.7.151","v0.7.150","v0.7.149","v0.7.148","v0.7.146","v0.7.145","v0.7.144","v0.7.143","v0.7.142","v0.7.141","v0.7.140","v0.7.139","v0.7.138","v0.7.137","v0.7.136","v0.7.135","v0.7.134","v0.7.133","v0.7.132","v0.7.129","v0.7.131","v0.7.130","v0.7.128","v0.7.127","v0.7.126","v0.7.125","v0.7.124","v0.7.123","v0.7.122","v0.7.121","v0.7.120","v0.7.119","v0.7.118","v0.7.117","v0.7.116","v0.7.115","v0.7.114","v0.7.113","v0.7.112","v0.7.111","v0.7.110","v0.7.109","v0.7.108","v0.7.107","v0.7.106","v0.7.105","v0.7.104","v0.7.103","v0.7.102","v0.7.101","v0.7.99","v0.7.95","v0.7.94","v0.7.93","v0.7.92","v0.7.91","v0.7.90","v0.7.89","v0.7.88","v0.7.87","v0.7.86","v0.7.85","v0.7.84","v0.7.83","v0.7.81","v0.7.82","v0.7.80","v0.7.79","v0.7.78","v0.7.77","v0.7.76","v0.7.75","v0.7.74","v0.7.73","v0.7.72","v0.7.71","v0.7.70","v0.7.67","v0.7.69","v0.7.66","v0.7.65","v0.7.64","v0.7.63","v0.7.62","v0.7.61","v0.7.60","v0.7.59","v0.7.58","v0.7.57","v0.7.56","v0.7.55","v0.7.54","v0.7.53","v0.7.52","v0.7.51","v0.7.50","v0.7.46","v0.7.45","v0.7.44","v0.7.43","v0.7.42","v0.7.41","v0.7.40","v0.7.39","v0.7.38","v0.7.33","v0.7.32","v0.7.31","v0.7.30","v0.7.29","v0.7.28","v0.7.26","v0.7.25","v0.7.24","v0.7.23","v0.7.22","v0.7.21","v0.7.20","v0.7.19","v0.7.18","v0.7.17","v0.7.16","v0.7.15","v0.7.14","v0.7.13","v0.7.12","v0.7.11-patch.3","v0.7.11-patch.2","v0.7.11","v0.7.11-patch.1","v0.7.10","v0.7.9","v0.7.8.patch-1","v0.7.8","v0.7.7","v0.7.6","v0.7.5","v0.7.4-patch.1","v0.7.4","v0.7.3-patch.4","v0.7.3-patch.2","v0.7.3-patch.3","v0.7.3","v0.7.2","v0.7.2-rc-2","v0.7.2-rc-1","v0.7.1","v0.7.0","v0.7.0-beta-4","v0.7.0-beta-3","v0.7.0-beta-2","v0.7.0-beta-1","v0.6.183","v0.6.184","v0.6.182","v0.6.181","v0.6.180","v0.6.179","v0.6.178","v0.6.177","v0.6.176","v0.6.175","v0.6.174","v0.6.173","v0.6.172","v0.6.171","v0.6.169","v0.6.168","v0.6.167","v0.6.166","v0.6.165","v0.6.162","v0.6.161","v0.6.160","v0.6.159","v0.6.158","v0.6.157","v0.6.156","v0.6.155","v0.6.154","v0.6.153","v0.6.152","v0.6.151","v0.6.150","v0.6.149","v0.6.148","v0.6.147","v0.6.146","v0.6.144","v0.6.142","v0.6.141","v0.6.140","v0.6.139","v0.6.138","v0.6.137","v0.6.136","v0.6.135","v0.6.134","v0.6.133","v0.6.132","v0.6.131","v0.6.129","v0.6.108","v0.6.107","v0.6.106","v0.6.105","v0.6.104","v0.6.103","v0.6.100","v0.6.98","v0.6.97","v0.6.96","v0.6.95","v0.6.94","v0.6.93","v0.6.92","v0.6.91","v0.6.90","v0.6.89","v0.6.88","v0.6.87","v0.6.86","v0.6.85","v0.6.84","v0.6.83","v0.6.82","v0.6.81","v0.6.80","v0.6.79","v0.6.78","v0.6.77","v0.6.76","v0.6.73","v0.6.75","v0.6.74","v0.6.72","v0.6.71","v0.6.70","v0.6.69","v0.6.68","v0.6.67","v0.6.66","v0.6.65","v0.6.64","v0.6.63","v0.6.62","v0.6.61","v0.6.60","v0.6.59","v0.6.58","v0.6.57","v0.6.56","v0.6.55","v0.6.54","v0.6.53","v0.6.52","v0.6.51","v0.6.50","v0.6.49","v0.6.48","v0.6.47","v0.6.10","v0.6.9","v0.6.8","v0.6.7","v0.6.6","v0.6.5","v0.6.4","v0.6.3","v0.6.2","v0.6.0-rc.6ff","v0.6.0-rc.6fe","v0.6.0-rc.6fd","v0.6.0-rc.6fc","v0.6.0-rc.6fb","v0.6.0-rc.6fa","v0.6.0-rc.6f","v0.6.0-rc.6e","v0.6.0-rc.6d","v0.6.0-rc.6c","v0.6.0-rc.6b","v0.6.0-rc.6a","v0.6.0-rc.6","v0.6.0-rc.5aa","v0.6.0-rc.5z","v0.6.0-rc.5y","v0.6.0-rc.5x","v0.6.0-rc.5w","v0.6.0-rc.5v","v0.6.0-rc.5u","v0.6.0-rc-5t","v0.6.0-rc.5s","v0.6.0-rc.5r","v0.6.0-rc.5q","v0.6.0-rc.5p","v0.6.0-rc.5o","v0.6.0-rc.5n","v0.6.0-rc.5m","v0.6.0-rc.5l","v0.6.0-rc.5k","v0.6.0-rc-5j","v0.6.0-rc-5h","v0.6.0-rc-5g","v0.6.0-rc-5f","v0.6.0-rc-5d","v0.6.0-rc-5c","v0.6.0-rc-5a","v0.6.0-rc-5","v0.6.0-rc-4","v0.6.0-rc-3","v0.6.0-rc-2","v0.6.0-rc-1","v0.5.72","v0.5.71","v0.5.70","v0.5.69","v0.5.68","v0.5.67","v0.5.66","v0.5.64","v0.5.65","v0.5.64-rc-2","v0.5.63-rc-1","v0.5.62","v0.5.61","v0.5.60","v0.5.59","v0.5.58","v0.5.57","v0.5.56","v0.5.55","v0.5.54","v0.5.53","v0.5.52","v0.5.51","v0.5.50","v0.5.49","v0.5.48","v0.5.47","v0.5.46","v0.5.45","v0.5.44","v0.5.43","v0.5.42","v0.5.39","v0.5.38","v0.5.37","v0.5.36","v0.5.34","v0.5.35","v0.5.33","v0.5.32","v0.5.31","v0.5.30","v0.5.29","v0.5.28","v0.5.27","v0.5.26","v0.5.25","v0.5.24","v0.5.23","v0.5.22","v0.5.21","v0.5.20","v0.5.19","v0.5.18","v0.5.17","v0.5.16","v0.5.15","v0.5.14","v0.5.13","v0.5.11","v0.5.10","v0.5.9","v0.5.8","v0.5.7","v0.5.6","v0.5.5","v0.5.4","v0.5.3","v0.5.2","v0.5.1","v0.5.0","v0.5.0-rc-6","v0.5.0-rc-5","v0.5.0-rc-4","v0.5.0-beta-4","v0.5.0-beta-3","v0.5.0-beta-2","v0.5.0-beta-1","v0.4.27","v0.4.26","v0.4.25","v0.4.24","v0.4.23","v0.4.15","v0.4.21","v0.4.22","v0.4.20","v0.4.18","v0.4.19","v0.4.14","v0.4.17","v0.4.13","v0.4.12","v0.4.11","v0.4.10","v0.4.9","v0.4.8","v0.4.7","v0.4.2","v0.4.6","v0.4.5","v0.4.4","v0.4.3","v0.4.1","v0.4.0","v0.4.0-rc.0","v0.4.0-beta.4","v0.4.0-beta.3","v0.4.0-beta.2","v0.3.19","v0.4.0-beta.1","v0.3.18","v0.3.17","v0.3.16","v0.3.15","v0.3.14","v0.3.13","v0.3.12","v0.3.11","v0.3.10","v0.3.9","v0.3.8","v0.3.7","v0.3.6","v0.3.5","v0.3.4","v0.3.3","v0.3.2","v0.3.1","v0.2.4","v0.2.3","v0.2.2","v0.2.1","v0.2.0","v0.1.6","v0.1.5","v0.1.4","v0.0.6","v0.1.3","v0.1.2","v0.0.7","v0.3.0","v0.0.3","v0.0.2","v0.1.0","v0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65919.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}