PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53519 nezhahq CVE debrief

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix leaves ../data/config.yaml; and path.Join('admin-dist', '../data/config.yaml') normalizes to data/config.yaml — which os.Stat finds and http.ServeFile returns. No authentication required. This issue has been patched in version 2.0.13.

Vendor
nezhahq
Product
nezha
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-12
Original CVE updated
2026-06-12
Advisory published
2026-06-12
Advisory updated
2026-06-12

Who should care

Users of Nezha Monitoring prior to version 2.0.13 should update to the latest version to prevent unauthorized access to sensitive files.

Technical summary

The vulnerability is caused by a flawed check in the NoRoute handler of the dashboard, which incorrectly handles URLs starting with /dashboard. This allows an attacker to access sensitive files without authentication.

Defensive priority

High

Recommended defensive actions

  • Update Nezha Monitoring to version 2.0.13 or later.
  • Restrict access to the dashboard to authorized users only.

Evidence notes

The vulnerability has a CVSS score of 9.1, indicating a critical severity.

Official resources

public