{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/nezha-monitoring--2.0.13/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nezhahq:nezha_monitoring:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-53519"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=BC1616F3-5603-5DF0-BC03-2E01A7A1107D\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Nezha Monitoring (\u003c 2.0.13)"],"_cs_severities":["critical"],"_cs_tags":["path-traversal","unauthenticated","webserver","credential-access","privilege-escalation","nezha-monitoring","cve"],"_cs_type":"advisory","_cs_vendors":["nezhahq"],"content_html":"\u003cp\u003eA severe pre-authentication path traversal vulnerability (CVE-2026-53519) has been discovered in Nezha Monitoring, affecting versions prior to 2.0.13. The flaw stems from a prefix confusion in the dashboard's \u003ccode\u003eNoRoute\u003c/code\u003e handler, where the \u003ccode\u003efallbackToFrontend\u003c/code\u003e function incorrectly processes URLs starting with \u003ccode\u003e/dashboard\u003c/code\u003e. By exploiting \u003ccode\u003estrings.HasPrefix\u003c/code\u003e and \u003ccode\u003epath.Join\u003c/code\u003e combined with Go's \u003ccode\u003ehttp.ServeFile\u003c/code\u003e behavior, an unauthenticated attacker can craft a malicious URL like \u003ccode\u003e/dashboard../data/config.yaml\u003c/code\u003e to bypass intended security checks and access sensitive files outside the \u003ccode\u003e/admin-dist\u003c/code\u003e directory. This allows for the exfiltration of critical data, most notably \u003ccode\u003edata/config.yaml\u003c/code\u003e, which contains the \u003ccode\u003ejwt_secret_key\u003c/code\u003e, and \u003ccode\u003edata/sqlite.db\u003c/code\u003e, which holds user account information. Possession of the \u003ccode\u003ejwt_secret_key\u003c/code\u003e enables the attacker to forge administrative JSON Web Tokens (JWTs), leading to full administrative account takeover of the Nezha Monitoring instance.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker sends an HTTP GET request to a crafted URL like \u003ccode\u003e/dashboard../data/config.yaml\u003c/code\u003e, targeting the Nezha Monitoring dashboard.\u003c/li\u003e\n\u003cli\u003eThe vulnerable \u003ccode\u003efallbackToFrontend\u003c/code\u003e handler's \u003ccode\u003estrings.HasPrefix\u003c/code\u003e check incorrectly matches \u003ccode\u003e/dashboard..\u003c/code\u003e, and \u003ccode\u003estrings.TrimPrefix\u003c/code\u003e leaves \u003ccode\u003e../data/config.yaml\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epath.Join(\u0026quot;admin-dist\u0026quot;, \u0026quot;../data/config.yaml\u0026quot;)\u003c/code\u003e normalizes the path to \u003ccode\u003edata/config.yaml\u003c/code\u003e, causing \u003ccode\u003eos.Stat\u003c/code\u003e to locate the sensitive file.\u003c/li\u003e\n\u003cli\u003eGo's \u003ccode\u003ehttp.ServeFile\u003c/code\u003e serves the \u003ccode\u003edata/config.yaml\u003c/code\u003e file to the attacker, bypassing its internal \u003ccode\u003e..\u003c/code\u003e-segment guard due to the non-canonical \u003ccode\u003e/dashboard..\u003c/code\u003e segment.\u003c/li\u003e\n\u003cli\u003eThe attacker extracts the \u003ccode\u003ejwt_secret_key\u003c/code\u003e from the exfiltrated \u003ccode\u003econfig.yaml\u003c/code\u003e and repeats the process to exfiltrate \u003ccode\u003edata/sqlite.db\u003c/code\u003e, identifying administrative user IDs.\u003c/li\u003e\n\u003cli\u003eUsing the \u003ccode\u003ejwt_secret_key\u003c/code\u003e and an administrative user ID, the attacker forges a valid HS256-signed JWT for an administrator account.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the forged JWT as a session cookie or Bearer token to gain full administrative access to the Nezha Monitoring dashboard, enabling actions like server management, user creation/deletion, and notification configuration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-53519 grants an unauthenticated attacker the ability to read any file within the dashboard's working directory subtree, provided it is one level up from \u003ccode\u003eadmin-dist\u003c/code\u003e. In default deployments, this includes \u003ccode\u003edata/config.yaml\u003c/code\u003e, which contains sensitive secrets such as the \u003ccode\u003ejwt_secret_key\u003c/code\u003e, \u003ccode\u003eagent_secret_key\u003c/code\u003e, OAuth2 client secrets, and GeoIP API keys. Additionally, \u003ccode\u003edata/sqlite.db\u003c/code\u003e can be exfiltrated, revealing the full dashboard state including all users (and their bcrypt password hashes), server registries, and API tokens. The primary impact is immediate administrative account takeover, allowing the attacker to fully control the Nezha Monitoring instance, potentially leading to data manipulation, unauthorized monitoring, or further compromise of integrated systems.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update Nezha Monitoring to version 2.0.13 or newer to patch CVE-2026-53519.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM to detect and alert on attempts to exploit CVE-2026-53519.\u003c/li\u003e\n\u003cli\u003eImplement Web Application Firewall (WAF) rules to block HTTP GET requests containing the \u003ccode\u003e/dashboard../data/config.yaml\u003c/code\u003e and \u003ccode\u003e/dashboard../data/sqlite.db\u003c/code\u003e patterns, including their URL-encoded variants listed in the IOCs.\u003c/li\u003e\n\u003cli\u003eReview access logs for the IOC URLs prior to patching to identify potential exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-10T09:11:42Z","date_published":"2026-07-03T10:22:16Z","id":"https://feed.craftedsignal.io/briefs/2026-07-nezha-path-traversal/","summary":"A critical pre-authentication path traversal vulnerability, CVE-2026-53519, in Nezha Monitoring's dashboard allows an unauthenticated attacker to read arbitrary files from the server's working directory, leading to the exfiltration of the `jwt_secret_key` and full administrative account takeover.","title":"Nezha Monitoring Pre-Auth Path Traversal via Dashboard Prefix Confusion (CVE-2026-53519)","url":"https://feed.craftedsignal.io/briefs/2026-07-nezha-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Nezha Monitoring (\u003c 2.0.13)","version":"https://jsonfeed.org/version/1.1"}