CVE-2026-53519

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions prior to 2.0.13

Description The dashboard's NoRoute handler contains a flaw in the fallbackToFrontend function. The system uses strings.HasPrefix to identify admin-frontend asset requests by checking if a URL starts with '/dashboard', rather than performing a proper path-segment match. This allows an unauthenticated user to use path traversal sequences, such as '/dashboard../data/config.yaml', to bypass intended restrictions. The application processes this input using strings.TrimPrefix and path.Join(), which normalizes the path to access sensitive files like 'data/config.yaml' via os.Stat and http.ServeFile.

Recommendations Update to version 2.0.13.