PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53519 nezhahq CVE debrief

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix leaves ../data/config.yaml; and path.Join('admin-dist', '../data/config.yaml') normalizes to data/config.yaml — which os.Stat finds and http.ServeFile returns. No authentication required. This issue has been patched in version 2.0.13.

Vendor
nezhahq
Product
nezha
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-12
Original CVE updated
2026-06-15
Advisory published
2026-06-12
Advisory updated
2026-06-15

Who should care

Users of Nezha Monitoring prior to version 2.0.13 should update to the latest version to prevent unauthorized access to sensitive files.

Technical summary

The vulnerability is caused by a flawed check in the NoRoute handler of the dashboard, which incorrectly handles URLs starting with /dashboard. This allows an attacker to access sensitive files without authentication.

Defensive priority

High

Recommended defensive actions

  • Update Nezha Monitoring to version 2.0.13 or later.
  • Restrict access to the dashboard to authorized users only.

Evidence notes

The vulnerability has a CVSS score of 9.1, indicating a critical severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-53519 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-53519

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-53519 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-53519

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.