CyberRota Analysis
AI-GeneratedMeshery versions prior to 1.0.57 are vulnerable to an unauthenticated arbitrary file read flaw in the /api/system/fileView and /api/system/fileDownload endpoints, allowing attackers to exploit user-supplied file parameters to access sensitive files on the host filesystem. This vulnerability poses a significant risk as it enables unauthorized access to potentially confidential data. Organizations using affected versions should prioritize patching to mitigate the risk of data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.