CVE-2026-53519

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix leaves ../data/config.yaml; and path.Join("admin-dist", "../data/config.yaml") normalizes to data/config.yaml — which os.Stat finds and http.ServeFile returns. No authentication required. This issue has been patched in version 2.0.13.

• CWE-22

• https://github.com/nezhahq/nezha/security/advisories/GHSA-5c25-7vpj-9mqh

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53513Better Auth is an authentication and authorization library f…9.6
• CVE-2026-53514Better Auth is an authentication and authorization library f…7.7
• CVE-2026-53515Better Auth is an authentication and authorization library f…7.1
• CVE-2026-53516Better Auth is an authentication and authorization library f…8.3
• CVE-2026-53517Better Auth is an authentication and authorization library f…8.1
• CVE-2026-53518Better Auth is an authentication and authorization library f…8.1
• CVE-2026-5352A security vulnerability has been detected in Trendnet TEW-6…8.8
• CVE-2026-53520Nezha Monitoring is a self-hostable, lightweight, servers an…6.5
• CVE-2026-53521Nezha Monitoring is a self-hostable, lightweight, servers an…6.4
• CVE-2026-53522Nezha Monitoring is a self-hostable, lightweight, servers an…6.5
• CVE-2026-53523Nezha Monitoring is a self-hostable, lightweight, servers an…6.8
• CVE-2026-5353A vulnerability was detected in Trendnet TEW-657BRM 1.00.1. …8.8