EUVD-2026-48342
GHSA-2x9h-mj6j-c376
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Meshery HTTP API
-
ExploitRequest /api/system/fileDownload with traversal path
-
Executionos.Open reads arbitrary host file
-
ImpactExfiltrate secrets/kubeconfig
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network access to a Meshery instance (before v1.0.57) whose /api/system/fileView or /api/system/fileDownload endpoints are reachable by the attacker; the attacker supplies an absolute path or '..' traversal sequence in the 'file' parameter. Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no special configuration, and no user interaction are needed against a default deployment. The primary limiting factor is reachability: an instance bound to localhost, firewalled, or fronted by an authenticating proxy is not directly exploitable, and the process's OS privileges bound which files can actually be read. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) describes a network-reachable, low-complexity, unauthenticated read with high confidentiality impact and no integrity or availability impact, scoring 8.7 (High) - an accurate profile for unauthenticated file disclosure. No EPSS score, KEV listing, or SSVC decision data was provided, so exploitation-probability and automatability signals are unknown and cannot be weighed. There is no confirmed public POC, but the patch commit (ea83a26) and issue #20076 openly describe the vulnerable endpoints and parameter, making exploit development trivial for a motivated attacker. Real-world priority hinges on exposure: a Meshery instance reachable from untrusted networks is a genuine high priority given trivial exploitation and sensitive-file disclosure (kubeconfigs, tokens, secrets), whereas instances bound to localhost or behind authentication proxies face substantially lower real risk. |
| Exploit ScenarioDerived | An attacker who can reach a Meshery server's HTTP API sends an unauthenticated request such as GET /api/system/fileDownload?file=/etc/passwd or with '../' traversal sequences, and the server returns the raw file contents. Because attack complexity is low and no privileges or user interaction are needed (AV:N/AC:L/PR:N/UI:N), the attacker can script bulk retrieval of sensitive files like kubeconfigs, environment files, and service-account tokens; the fix commit publicly documents the exact endpoints and parameter, lowering the barrier to weaponization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Unauthenticated arbitrary file read in Meshery before 1.0.57 lets remote attackers retrieve any file on the host by abusing the /api/system/fileView and /api/system/fileDownload endpoints, which pass a user-controlled file parameter straight to os.Open with no path validation. Reported by VulnCheck and fixed in v1.0.57, it carries a CVSS 4.0 score of 8.7 and requires no authentication or user interaction; no public exploit identified at time of analysis, though the fix commit publicly reveals the exact vulnerable code path.
RemediationAI
Vendor-released patch: upgrade to Meshery v1.0.57 or later, which adds path-traversal prevention in the file handlers (commit ea83a26cb090b13be36c07cf24a99f8c637cc765, PR #20133). If immediate upgrade is not possible, restrict network exposure of the Meshery server by binding it to localhost or placing it behind an authenticating reverse proxy, and block or filter external access to the /api/system/fileView and /api/system/fileDownload endpoints at the ingress/WAF layer - noting that blocking these paths may disable legitimate in-product file view/download features. Additionally, run the Meshery process under a least-privileged account so that even a successful read is limited to files that account can access. Consult the vendor advisory (https://github.com/meshery/meshery/releases/tag/v1.0.57) and the VulnCheck advisory for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Meshery is an open-source cloud-native management plane for service meshes and Kubernetes, commonly run as a self-hosted server exposing a REST/HTTP API. The flaw is a classic CWE-22 path traversal: two Go HTTP handlers accept a 'file' request parameter and hand it directly to os.Open without canonicalizing the path, checking for '..' traversal sequences, or constraining reads to an intended base directory. Because Go's os.Open honors both absolute paths (e.g. /etc/passwd) and relative traversal (e.g. ../../), any string the attacker supplies is resolved against the filesystem with the privileges of the Meshery server process. The CPE cpe:2.3:a:meshery:meshery:*:*:*:*:*:*:*:* confirms the Meshery application itself is affected across versions prior to the fix.
Know when Meshery gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable, unauthenticated, low-complexity file read with no user interaction gives AV:N/AC:L/PR:N/UI:N; impact is confidentiality-only (C:H, I:N, A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.
Executive ViewAI
Meshery versions before 1.0.57 contain an unauthenticated arbitrary file read vulnerability (CVSS 8.7) that allows remote attackers to download any file from affected systems without credentials or user interaction. This vulnerability could expose application secrets, database credentials, and sensitive configuration data, directly compromising the integrity of dependent infrastructure. Immediate patching to v1.0.57 is critical for all Meshery deployments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL comman
Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructur
Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructur
Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructur
Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and escalate privileges by obtaining t
A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensit
Exploit-DB