CVE-2026-53519
published 2026-06-12CVE-2026-53519: Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's…
PriorityP270critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EXPLOIT
EPSS
1.93%
78.5th percentile
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix leaves ../data/config.yaml; and path.Join("admin-dist", "../data/config.yaml") normalizes to data/config.yaml — which os.Stat finds and http.ServeFile returns. No authentication required. This issue has been patched in version 2.0.13.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | nezhahq_nezha | >= 0 < 2.0.13 | 2.0.13 |
| nezhahq | nezha | < 2.0.13 | 2.0.13 |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
ghsa·2026-06-26
CVE-2026-53519 [CRITICAL] CWE-22 Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
### Summary
`fallbackToFrontend` in the dashboard's `NoRoute` handler treats any URL whose **raw string** starts with `/dashboard` as an admin-frontend asset request. The check uses `strings.HasPrefix`, not a path-segment match, so the input `/dashboard../data/config.yaml` is accepted; `strings.TrimPrefix` leaves `../data/config.yaml`; and `path.Join("admin-dist", "../data/config.yaml")` normalizes to `data/config.yaml` — which `os.Stat` finds and `http.ServeFile` returns. No authentication required.
In default deployments (the values shipped in `model/config.go` and the layout shipped in the project `Dockerfile`) `data/config.yaml` contains the HS256 `jwt_secret_key` used by `cmd/dashboard/c
VulDB
nezhahq nezha up to 2.0.12 NoRoute /data/config.yaml path traversal (GHSA-5c25-7vpj-9mqh)
vuldb·2026-06-13·CVSS 9.1
CVE-2026-53519 [CRITICAL] nezhahq nezha up to 2.0.12 NoRoute /data/config.yaml path traversal (GHSA-5c25-7vpj-9mqh)
A vulnerability classified as critical has been found in nezhahq nezha up to 2.0.12. This impacts an unknown function of the file /data/config.yaml of the component NoRoute Handler. The manipulation leads to path traversal.
This vulnerability is referenced as CVE-2026-53519. Remote exploitation of the attack is possible. No exploit is available.
It is recommended to upgrade the affected component.
No detection rules found.
Nuclei
Nezha Dashboard < 2.0.13 - Path Traversal
nuclei·CVSS 9.1
CVE-2026-53519 [CRITICAL] Nezha Dashboard < 2.0.13 - Path Traversal
Nezha Dashboard < 2.0.13 - Path Traversal
Nezha Monitoring < 2.0.13 contains a path traversal caused by improper prefix checking in the dashboard's NoRoute handler, letting unauthenticated attackers read arbitrary files via crafted URLs.
Template:
id: CVE-2026-53519
info:
name: Nezha Dashboard < 2.0.13 - Path Traversal
author: str4k3r
severity: critical
description: |
Nezha Monitoring < 2.0.13 contains a path traversal caused by improper prefix checking in the dashboard's NoRoute handler, letting unauthenticated attackers read arbitrary files via crafted URLs.
impact: |
Unauthenticated attackers can read arbitrary files on the server, potentially exposing sensitive configuration or data files.
remediation: |
Update to version 2.0.13 or later.
reference:
- https://github.com/nezhahq/nez
No writeups or analysis indexed.
2026-06-12
Published