{"items":[{"id":"NVI-00017787","kind":"vulnerability","title":"Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-5c25-7vpj-9mqh","CVE-2026-53519"],"plain_summary":"GitHub lists this reviewed advisory for github.com/nezhahq/nezha. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-64d3d9006cb11caeb18b3d3e44cd18df"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-26T23:03:14.000Z","value":"9.1 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-64d3d9006cb11caeb18b3d3e44cd18df"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-64d3d9006cb11caeb18b3d3e44cd18df","url":"https://github.com/advisories/GHSA-5c25-7vpj-9mqh","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-5c25-7vpj-9mqh","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T19:05:04.022Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-64d3d9006cb11caeb18b3d3e44cd18df"],"technology":"github.com/nezhahq/nezha","known_exclusions":[],"conditions_summary":"### Summary\n`fallbackToFrontend` in the dashboard's `NoRoute` handler treats any URL whose **raw string** starts with `/dashboard` as an admin-frontend asset request. The check uses `strings.HasPrefix`, not a path-segment match, so the input `/dashboard../data/config.yaml` is accepted; `strings.TrimPrefix` leaves `../data/config.yaml`; and `path.Join(\"admin-dist\", \"../data/config.yaml\")` normalizes to `data/config.yaml` — which `os.Stat` finds and `http.ServeFile` returns. No authentication required.\n \nIn default deployments (the values shipped in `model/config.go` and the layout shipped in the project `Dockerfile`) `data/config.yaml` contains the HS256 `jwt_secret_key` used by `cmd/dashboard/controller/jwt.go` to sign every dashboard session cookie. A unauth attacker reads that secret, forges an admin JWT, and signs in as any user — full dashboard takeover from one GET request.\n\n### Details\n## Root cause\n \n```go\n// cmd/dashboard/controller/controller.go @ 636f4a9\n387:    fallbackStatusCode := getFallbackStatusCode(c.Request.URL.Path)\n388:    if strings.HasPrefix(c.Request.URL.Path, \"/dashboard\") {\n389:        stripPath := strings.TrimPrefix(c.Request.URL.Path, \"/dashboard\")\n390:  ","public_affected_ranges":["< 2.0.13"]}],"null_published_at":"2026-11-05T19:10:21.468Z","source_updated_at":"2026-06-26T23:03:14.000Z","source_disclosed_at":"2026-06-26T23:03:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T19:05:04.022Z"}],"next_cursor":null,"snapshot_revision":"42594"}