{"id":16781,"date":"2026-09-04T19:05:36","date_gmt":"2026-09-04T11:05:36","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-53519"},"modified":"2026-09-04T19:05:36","modified_gmt":"2026-09-04T11:05:36","slug":"cve-2026-53519","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-53519","title":{"rendered":"CVE-2026-53519 [CRITICAL] &#8211; Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&amp;M"},"content":{"rendered":"<p>Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&amp;M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard&#8217;s NoRoute handler treats any URL whose raw string starts with \/dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input \/dashboard..\/data\/config.yaml is accepted; strings.TrimPrefix leaves ..\/data\/config.yaml; and path.Join(&#8220;admin-dist&#8221;, &#8220;..\/data\/config.yaml&#8221;) normalizes to data\/config.yaml \u2014 which os.Stat finds and http.ServeFile returns. No authentication required. This issue has been patched in version 2.0.13.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&amp;M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard&#8217;s NoRoute handler treats any URL whose raw <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-16781","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/16781","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16781"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16781"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16781"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}