Meshery versions prior to 1.0.57 have an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints. These endpoints improperly handle user-supplied file parameters without validating paths, allowing attackers to read arbitrary files on the host filesystem without authentication.