Meshery servers older than version 1.0.57 expose a path‑traversal flaw that allows an unauthenticated attacker to read any file on the host filesystem. The flaw stems from passing the user‑supplied \"file\" argument directly into os.Open without validating or sanitizing the path. An attacker can request absolute paths or leverage traversal sequences such as \"../\" to access arbitrary files. The result is unauthorized disclosure of potentially sensitive configuration files, credentials, or other critical data. The weakness is classified as CWE‑22 and can compromise confidentiality of the system’s data at the application level.

Meshery deployments running any version earlier than 1.0.57. This includes any environment where the open‑source Meshery service is deployed without the latest security release. No specific operating system or platform restrictions are indicated beyond those that support Meshery; therefore, all installations of Meshery under the affected version range are impacted.

The CVSS score of 8.7 indicates high severity, and the very low EPSS (< 1%) suggests that large‑scale exploitation is unlikely in the near term. However, because the vulnerability is unauthenticated and the affected endpoints are exposed over HTTP/HTTPS, an attacker can remotely trigger the flaw from any network location that can reach the service. The lack of authentication and direct file access means that even a low‑skill adversary can benefit from reading privileged files. Although not listed in the CISA KEV catalog, the flaw is publicly documented and could be leveraged by threat actors seeking to exfiltrate configuration or credential information.