Path Traversal Vulnerability in Nezha Monitoring Dashboard
CVE-2026-53519
9.1CRITICAL
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-53519?
Nezha Monitoring, a self-hostable tool for monitoring servers and websites, has a path traversal vulnerability prior to version 2.0.13. The NoRoute handler in the dashboard improperly validates URLs, treating any URL that begins with '/dashboard' as an admin-frontend asset request. This flaw allows malicious inputs, such as '/dashboard../data/config.yaml', to bypass authentication and access sensitive files directly. The vulnerability has been resolved in version 2.0.13.
Affected Version(s)
nezha < 2.0.13
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.