Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-53519: Nezha Monitoring lets anyone read configuration file

CVE-2026-53519 · published 4 months ago

Summary

The Nezha Monitoring tool (versions before 2.0.13) can serve internal files without asking for a login. By requesting a specially crafted URL, an attacker can view files such as the jwt_secret_key that should be private. Upgrade to version 2.0.13 or later to close this gap.

What to do

Update github.com nezhahq to version 2.0.13.

Affected software

Ecosystem	Vendor	Product	Affected versions
go	github.com	nezhahq	< 2.0.13 Fix: upgrade to 2.0.13

Original advisory text

Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix leaves ../data/config.yaml; and path.Join("admin-dist", "../data/config.yaml") normalizes to data/config.yaml — which os.Stat finds and http.ServeFile returns. No authentication required. This issue has been patched in version 2.0.13.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-53519 Vendor Advisory
https://github.com/advisories/GHSA-5c25-7vpj-9mqh
https://github.com/nezhahq/nezha/security/advisories/GHSA-5c25-7vpj-9mqh Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53519... Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.1 Critical

Exploitation

2% chance of attack within 30 days

Type

CWE-22Path Traversal

Timeline

Published12 Jun 2026

Updated30 Oct 2026

First seen12 Jun 2026

Sources

CVE-2026-53519 · NVD

GHSA-5c25-7vpj-9mqh · GHSA

CVE-2026-53519 · OSV

Track software like this

Free during beta