{"id":"EUVD-2026-36598","enisaUuid":"e11a7f55-c820-35be-8a15-5f832f9877ed","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard\u0027s NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix leaves ../data/config.yaml; and path.Join(\"admin-dist\", \"../data/config.yaml\") normalizes to data/config.yaml — which os.Stat finds and http.ServeFile returns. No authentication required. This issue has been patched in version 2.0.13.","datePublished":"Jun 12, 2026, 9:03:48 PM","dateUpdated":"Jun 15, 2026, 6:27:12 PM","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-5c25-7vpj-9mqh\n","aliases":"CVE-2026-53519\nGHSA-5c25-7vpj-9mqh\n","assigner":"GitHub_M","epss":1.93,"enisaIdProduct":[{"id":"fe71b8ca-ead8-3d89-93b6-55f90dff5b0f","product":{"name":"nezha","vendor":{"name":"nezhahq"}},"product_version":"\u003c 2.0.13"}],"enisaIdVendor":[{"id":"00e88442-36c8-31f2-9ec3-58bd9e28f4d7","vendor":{"name":"nezhahq"}}],"enisaIdVulnerability":[{"id":"0fafb83c-6126-36ea-b735-1ca226eae874","vulnerability":{"id":"GHSA-5c25-7vpj-9mqh","description":"Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key","datePublished":"Jun 26, 2026, 11:03:13 PM","dateUpdated":"Jun 26, 2026, 11:03:13 PM","baseScore":0.0,"references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-5c25-7vpj-9mqh\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53519\nhttps://github.com/nezhahq/nezha\n","enisa_id":"EUVD-2026-36598\n","aliases":"GHSA-5c25-7vpj-9mqh\nCVE-2026-53519\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"94c0c963-73b8-3a1e-ae39-b8ee31b23618","vulnerability":{"id":"CVE-2026-53519","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard\u0027s NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix leaves ../data/config.yaml; and path.Join(\"admin-dist\", \"../data/config.yaml\") normalizes to data/config.yaml — which os.Stat finds and http.ServeFile returns. No authentication required. This issue has been patched in version 2.0.13.","datePublished":"Jun 12, 2026, 9:03:48 PM","dateUpdated":"Jun 15, 2026, 6:27:12 PM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-5c25-7vpj-9mqh\n","enisa_id":"EUVD-2026-36598\n","assigner":"GitHub_M","epss":1.93,"dataProcessed":"Nov 3, 2026, 7:16:37 AM","vulnerabilityProduct":[{"id":"2720b1fc-cc22-3406-a212-f3cad121fddb","product":{"name":"nezha","vendor":{"name":"nezhahq"}},"product_version":"\u003c 2.0.13"}],"vulnerabilityVendor":[{"id":"7ccbb174-7f16-3914-bb25-8dda46d0a879","vendor":{"name":"nezhahq"}}]}}],"enisaIdAdvisory":[]}