Host Header Injection Vulnerability in Nezha by Nezha HQ
CVE-2026-111385

6.3MEDIUM

Key Information:

Vendor

Nezhahq

Status
Nezha
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111385?

Nezha versions 2.1.0 through 2.3.14 are susceptible to a host header injection vulnerability in the mintTransferTool component. This flaw arises from the improper handling of the Host header in generated file transfer URLs. Malicious actors can exploit this vulnerability to manipulate file upload processes, allowing them to redirect uploads or capture one-time download tokens, consequently exfiltrating sensitive files from the system. It is crucial for users to upgrade to version 2.3.15 or later to mitigate the risks associated with this vulnerability.

Affected Version(s)

nezha 2.1.0 < 2.3.15

nezha 2.3.15

References

https://github.com/nezhahq/nezha/security/advisories/GHSA...
vendor-advisory
https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed78...
patch
https://github.com/nezhahq/nezha/commit/c726930833937a0ae...
patch

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
.