https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:56:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-327355 EUVD-2026-327355 https://cve.radiocsirt.org/vuln/euvd-2026-327355 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53519 <p>Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&amp;M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard&#39;s NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix leaves ../data/config.yaml; and path.Join(&#34;admin-dist&#34;, &#34;../data/config.yaml&#34;) normalizes to data/config.yaml — which os.Stat finds and http.ServeFile returns. No authentication required. This issue has been patched in version 2.0.13.</p> <p>Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&amp;M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard&#39;s NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix leaves ../data/config.yaml; and path.Join(&#34;admin-dist&#34;, &#34;../data/config.yaml&#34;) normalizes to data/config.yaml — which os.Stat finds and http.ServeFile returns. No authentication required. This issue has been patched in version 2.0.13.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53519 https://cve.radiocsirt.org/vuln/ghsa-5c25-7vpj-9mqh <p><strong>Affected:</strong> Go: github.com/nezhahq/nezha</p> <p>### Summary `fallbackToFrontend` in the dashboard&#39;s `NoRoute` handler treats any URL whose **raw string** starts with `/dashboard` as an admin-frontend asset request. The check uses `strings.HasPrefix`, not a path-segment match, so the input `/dashboard../data/config.yaml` is accepted; `strings.TrimPrefix` leaves `../data/config.yaml`; and `path.Join(&#34;admin-dist&#34;, &#34;../data/config.yaml&#34;)` normalizes to `data/config.yaml` — which `os.Stat` finds and `http.ServeFile` returns. No authentication required. In default deployments (the values shipped in `model/config.go` and the layout shipped in the project `Dockerfile`) `data/config.yaml` contains the HS256 `jwt_secret_key` used by `cmd/dashboard/controller/jwt.go` to sign every dashboard session cookie. A unauth attacker reads that secret, forges an admin JWT, and signs in as any user — full dashboard takeover from one GET request.</p> <p>### Details ## Root cause ```go // cmd/dashboard/controller/controller.go @ 636f4a9 387: fallbackStatusCode := getFallbackStatusCode(c.Request.URL.Path) 388: if strings.HasPrefix(c.Request.URL.Path, &#34;/dashboard&#34;) { 389: stripPath := strings.TrimPrefix(c.Request.URL.Path, &#34;/dashboard&#34;) 390: localFilePath := path.Join(singleton.Conf.AdminTemplate, stripPath) 391: if checkLocalFileOrFs(c, frontendDist, localFilePath, http.StatusOK) { 392: return 393: } ``` ```go // cmd/dashboard/controller/controller.go @ 636f4a9 322: func fallbackToFrontend(frontendDist…</p> <p><strong>Affected:</strong> Go: github.com/nezhahq/nezha</p> <p>### Summary `fallbackToFrontend` in the dashboard&#39;s `NoRoute` handler treats any URL whose **raw string** starts with `/dashboard` as an admin-frontend asset request. The check uses `strings.HasPrefix`, not a path-segment match, so the input `/dashboard../data/config.yaml` is accepted; `strings.TrimPrefix` leaves `../data/config.yaml`; and `path.Join(&#34;admin-dist&#34;, &#34;../data/config.yaml&#34;)` normalizes to `data/config.yaml` — which `os.Stat` finds and `http.ServeFile` returns. No authentication required. In default deployments (the values shipped in `model/config.go` and the layout shipped in the project `Dockerfile`) `data/config.yaml` contains the HS256 `jwt_secret_key` used by `cmd/dashboard/controller/jwt.go` to sign every dashboard session cookie. A unauth attacker reads that secret, forges an admin JWT, and signs in as any user — full dashboard takeover from one GET request.</p> <p>### Details ## Root cause ```go // cmd/dashboard/controller/controller.go @ 636f4a9 387: fallbackStatusCode := getFallbackStatusCode(c.Request.URL.Path) 388: if strings.HasPrefix(c.Request.URL.Path, &#34;/dashboard&#34;) { 389: stripPath := strings.TrimPrefix(c.Request.URL.Path, &#34;/dashboard&#34;) 390: localFilePath := path.Join(singleton.Conf.AdminTemplate, stripPath) 391: if checkLocalFileOrFs(c, frontendDist, localFilePath, http.StatusOK) { 392: return 393: } ``` ```go // cmd/dashboard/controller/controller.go @ 636f4a9 322: func fallbackToFrontend(frontendDist…</p> https://cve.radiocsirt.org/vuln/ghsa-5c25-7vpj-9mqh