EUVD-2026-36598
GHSA-5c25-7vpj-9mqh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Remotely reachable HTTP endpoint, no auth or interaction (AV:N/AC:L/PR:N/UI:N); http.ServeFile is read-only so C:H but I:N/A:N for direct impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix leaves ../data/config.yaml; and path.Join("admin-dist", "../data/config.yaml") normalizes to data/config.yaml - which os.Stat finds and http.ServeFile returns. No authentication required. This issue has been patched in version 2.0.13.
AnalysisAI
Unauthenticated path traversal in Nezha Monitoring (nezhahq/nezha) before 2.0.13 allows remote attackers to read arbitrary files from the dashboard host by abusing the NoRoute fallbackToFrontend handler. The handler matches the /dashboard prefix with strings.HasPrefix rather than a path-segment comparison, so a request like /dashboard../data/config.yaml is normalized by path.Join into the application's data directory and served by http.ServeFile. No public exploit identified at time of analysis, but the bypass is trivially reproducible from the disclosed root-cause writeup.
Technical ContextAI
Nezha is a self-hosted Go-based server and website monitoring/O&M platform whose dashboard embeds a frontend bundle under the admin-dist directory and falls back to serving frontend assets for any unmatched route beginning with /dashboard. The flaw is a textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) caused by treating URL prefixes as opaque strings: strings.HasPrefix(url, "/dashboard") returns true for /dashboard../..., strings.TrimPrefix leaves ../data/config.yaml, and Go's path.Join collapses the traversal so http.ServeFile happily returns files outside admin-dist. The proper fix, shipped in 2.0.13, requires checking that /dashboard is a full path segment (e.g., comparing segments after splitting on '/') rather than a literal byte prefix.
RemediationAI
Vendor-released patch: upgrade to Nezha 2.0.13 or later, which replaces the strings.HasPrefix check with a path-segment match; see the upstream advisory at https://github.com/nezhahq/nezha/security/advisories/GHSA-5c25-7vpj-9mqh for the fix commit. If immediate upgrade is not possible, place the dashboard behind a reverse proxy (nginx, Caddy, Traefik) that normalizes URLs and rejects any request whose decoded path contains '..' or matches the regex ^/dashboard[^/], and restrict dashboard exposure to a VPN or trusted IP allowlist; note that URL-normalizing proxies can also break legitimate frontend asset URLs that contain encoded characters, so test the dashboard after deploying such rules. After patching, rotate every secret stored in data/config.yaml (database password, OAuth client secrets, agent shared secret, JWT signing key) under the assumption the file may have been read.
Cross-tenant session hijacking in Nezha Monitoring (v1.14.13-1.14.14 and v2.0.0-2.0.9) lets any authenticated low-privil
Nezha Monitoring versions prior to 2.2.5 expose stored third-party API credentials in plaintext through two listing API
Host header injection in Nezha Monitoring versions 1.0.0 through 2.2.0 allows unauthenticated remote attackers to redire
Unbounded WebSocket stream allocation in Nezha Monitoring versions 1.0.0 through 2.1.x allows any authenticated dashboar
Nezha Monitoring versions 2.0.14 through 2.1.0 (exclusive) allows any authenticated user to exploit the NAT-based Host c
Incorrect authorization in Nezha Monitoring's DDNS profile subsystem allows an authenticated low-privilege member to pre
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today