{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/meshery/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-65919"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Meshery (before 1.0.57)"],"_cs_severities":["high"],"_cs_tags":["path-traversal","arbitrary-file-read","web-vulnerability","meshery"],"_cs_type":"threat","_cs_vendors":["Meshery"],"content_html":"\u003cp\u003eCVE-2026-65919 details a critical unauthenticated arbitrary file read vulnerability affecting Meshery software versions prior to 1.0.57. This flaw is present in the \u003ccode\u003e/api/system/fileView\u003c/code\u003e and \u003ccode\u003e/api/system/fileDownload\u003c/code\u003e API endpoints, which improperly handle user-supplied file parameters. Specifically, these endpoints pass arbitrary input directly to the \u003ccode\u003eos.Open\u003c/code\u003e function without implementing crucial path validation. This oversight allows an attacker to inject path traversal sequences (e.g., \u003ccode\u003e../\u003c/code\u003e, \u003ccode\u003e../../\u003c/code\u003e) or provide absolute file paths, enabling them to bypass directory restrictions and read any file on the host's underlying filesystem. The vulnerability is highly severe (CVSS 7.5 High) because it does not require authentication, making it accessible to any unauthenticated actor. The impact could range from exposure of sensitive configuration files and user data to system credentials, posing a significant risk to the integrity and confidentiality of the Meshery deployment.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker sends an HTTP GET request to either the \u003ccode\u003e/api/system/fileView\u003c/code\u003e or \u003ccode\u003e/api/system/fileDownload\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe attacker includes a \u003ccode\u003efile\u003c/code\u003e parameter in the request's query string.\u003c/li\u003e\n\u003cli\u003eThe value of the \u003ccode\u003efile\u003c/code\u003e parameter contains a path traversal sequence (e.g., \u003ccode\u003e../../../../etc/passwd\u003c/code\u003e) or an absolute path (e.g., \u003ccode\u003e/etc/shadow\u003c/code\u003e, \u003ccode\u003eC:\\\\Windows\\\\System32\\\\drivers\\\\etc\\\\hosts\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe vulnerable Meshery application processes the request, passing the malicious \u003ccode\u003efile\u003c/code\u003e parameter directly to the \u003ccode\u003eos.Open\u003c/code\u003e function without proper sanitization or validation.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eos.Open\u003c/code\u003e function attempts to read the file specified by the attacker's manipulated path outside the intended directory.\u003c/li\u003e\n\u003cli\u003eThe content of the requested arbitrary file is returned in the HTTP response body to the attacker.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully exfiltrates sensitive system files, configuration, or credentials.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-65919 allows an unauthenticated attacker to read any file on the server hosting Meshery. This could lead to the exposure of highly sensitive information, such as system configuration files, private keys, database credentials, user account details, and other proprietary data. While the NVD does not specify observed exploitation in the wild or victim counts, the ability for any unauthenticated actor to access arbitrary files without interaction makes this a critical data confidentiality risk. Compromised data could lead to further system compromise, privilege escalation, or lateral movement within an organization's network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-65919 immediately by updating Meshery to version 1.0.57 or later, as referenced in \u003ca href=\"https://github.com/meshery/meshery/releases/tag/v1.0.57\"\u003ehttps://github.com/meshery/meshery/releases/tag/v1.0.57\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detects CVE-2026-65919 Exploitation - Meshery Path Traversal\u0026quot; to your SIEM to detect attempts to exploit the \u003ccode\u003e/api/system/fileView\u003c/code\u003e and \u003ccode\u003e/api/system/fileDownload\u003c/code\u003e endpoints with path traversal sequences.\u003c/li\u003e\n\u003cli\u003eEnsure webserver logs (category: webserver) are collected and monitored for suspicious activity, particularly for requests containing unusual characters or pathing in URI query parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T18:25:27Z","date_published":"2026-07-23T18:25:27Z","id":"https://feed.craftedsignal.io/briefs/2026-07-meshery-file-read/","summary":"Meshery versions prior to 1.0.57 are vulnerable to an unauthenticated arbitrary file read due to a path traversal flaw in the /api/system/fileView and /api/system/fileDownload API endpoints, allowing attackers to read arbitrary files from the host filesystem without authentication by supplying path traversal sequences.","title":"CVE-2026-65919 Unauthenticated Arbitrary File Read in Meshery","url":"https://feed.craftedsignal.io/briefs/2026-07-meshery-file-read/"}],"language":"en","title":"CraftedSignal Threat Feed - Meshery","version":"https://jsonfeed.org/version/1.1"}