CVE-2026-53519: 
vulnerability analysis and mitigation

CVE-2026-53519 is a pre-authentication path traversal vulnerability in Nezha Monitoring, a self-hostable server and website monitoring tool. The flaw exists in the fallbackToFrontend function of the dashboard's NoRoute handler, which uses an insecure string prefix check (strings.HasPrefix) instead of a proper path-segment match, allowing attackers to escape the intended directory and read arbitrary files — including the jwt_secret_key — without any authentication. All versions prior to 2.0.13 of the github.com/nezhahq/nezha Go module are affected. The vulnerability was published on May 31, 2026, and assigned a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Nezha Security Advisory).

The root cause is CWE-22 (Path Traversal): the fallbackToFrontend handler at cmd/dashboard/controller/controller.go checks whether a URL path starts with /dashboard using strings.HasPrefix, which is a raw substring match rather than a path-segment boundary check. A crafted URL such as /dashboard../data/config.yaml passes this check because the first segment is dashboard.. (not a standalone ..), bypassing Go's stdlib http.ServeFile dot-dot guard that only fires on URLs containing a standalone .. segment. After strings.TrimPrefix removes /dashboard, the remainder ../data/config.yaml is passed to path.Join("admin-dist", "../data/config.yaml"), which normalizes to data/config.yaml — a file that os.Stat finds and http.ServeFile returns with HTTP 200. The attack requires no authentication, no special privileges, and no user interaction; it is fully automatable via a single HTTP GET request. Encoded variants (/dashboard%2e%2e/data/config.yaml, /dashboard..%2fdata/config.yaml) also succeed (GitHub Advisory, Nezha Security Advisory).

Successful exploitation allows an unauthenticated remote attacker to read any file within the dashboard's working directory subtree. In default deployments, this includes data/config.yaml (containing the HS256 jwt_secret_key, agent_secret_key, OAuth2 client secrets, and API keys) and data/sqlite.db (containing admin user records, bcrypt password hashes, server registry, API tokens, and notification configs). Because the JWT signing key is symmetric (HS256), an attacker who reads it can forge valid admin session tokens, achieving full dashboard takeover — including CRUD access to servers, users, cron tasks, notifications, and OAuth2 settings — via just two unauthenticated HTTP GET requests and a JWT signing operation (GitHub Advisory, Nezha Security Advisory).

1. Reconnaissance: Identify internet-facing Nezha Monitoring dashboard instances (versions < 2.0.13) using tools like Shodan or Censys, searching for the Nezha dashboard login page or characteristic HTTP headers.
2. Extract configuration file: Send a crafted unauthenticated HTTP GET request using --path-as-is to prevent client-side URL normalization:

   curl -s -i --path-as-is 'http://<target>/dashboard../data/config.yaml'

   Alternatively, use URL-encoded variants: /dashboard%2e%2e/data/config.yaml or /dashboard..%2fdata/config.yaml. The server responds with HTTP 200 and the full YAML config, including jwt_secret_key.
3. Extract the SQLite database: Retrieve the database to obtain admin user IDs:

   curl -s --path-as-is 'http://<target>/dashboard../data/sqlite.db' -o sqlite.db

   Open the file locally and query the users table to identify the admin user_id.
4. Forge an admin JWT: Using the extracted jwt_secret_key and admin user_id, mint a valid HS256 JWT with the appropriate claims (e.g., using PyJWT or the provided PoC script):

   import jwt
   token = jwt.encode({'user_id': <admin_id>}, '<jwt_secret_key>', algorithm='HS256')

5. Authenticate as admin: Attach the forged token as the nz-jwt cookie or Authorization: Bearer header in subsequent requests to the dashboard API, gaining full administrative access to all dashboard functions (GitHub Advisory, Nezha Security Advisory).

• Network: HTTP GET requests to paths matching /dashboard../, /dashboard%2e%2e/, or /dashboard..%2f patterns in web server access logs; requests for data/config.yaml or data/sqlite.db via the dashboard endpoint; unusual outbound connections from the Nezha dashboard host following such requests.
• Logs: Access log entries with HTTP 200 responses to paths containing dashboard.. or URL-encoded dot sequences (e.g., %2e%2e, %2f) targeting data/config.yaml or data/sqlite.db; authentication events for admin accounts from unexpected IP addresses or at unusual times following the file read requests.
• File System: Unexpected copies or downloads of data/config.yaml or data/sqlite.db from the dashboard working directory; evidence of the SQLite database being opened or queried from an external host.
• Application Behavior: New admin sessions or JWT tokens appearing in the dashboard from IP addresses that have no prior login history; unexpected changes to server configurations, cron tasks, users, or notification settings in the dashboard (GitHub Advisory).

Upgrade Nezha Monitoring to version 2.0.13 or later, which patches the vulnerability by replacing the insecure strings.HasPrefix check with a segment-aware prefix match requiring a trailing slash (/dashboard/) and adding a path escape check before any filesystem call (GitHub Advisory, Nezha Security Advisory). If immediate upgrade is not possible, restrict network-level access to the dashboard port to trusted IP ranges only. After patching, rotate the jwt_secret_key and agent_secret_key in data/config.yaml, as well as any OAuth2 client secrets or API keys stored there, since these may have been exposed to unauthenticated attackers on unpatched instances.

The vulnerability received coverage from The Hacker Wire, which published a dedicated technical article on the unauthenticated file read issue (The Hacker Wire). A Reddit thread in r/pwnhub highlighted the critical nature of the unauthenticated file read primitive (Reddit). The vulnerability was also noted in the security community via Mastodon and Infosec.exchange, and was included in a PoC-of-the-week roundup by security researcher Tony Harris (tonyharris.io).