VulnSocial

CVE-2026-53519Active Exploitation

MEDIUMCVSS 9.1 · CRITICAL

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix leaves ../data/config.yaml; and path.Join("admin-dist", "../data/config.yaml") normalizes to data/config.yaml — which os.Stat finds and http.ServeFile returns. No authentication required. This issue has been patched in version 2.0.13.

Back to dashboard
5.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 2 classified signals
  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 5 mentions across 3 observed days

What's happening

  • Active exploitation reported across 2 signals
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Peaked 1d ago at 3 mentions (2026-06-18); latest day: 1
  • 5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d
01223Mentions · 2026-06-14: 1Mentions · 2026-06-18: 3Mentions · 2026-08-13: 1PoC Mentioned / Linked · 2026-06-18: 1Active Exploitation · 2026-06-18: 2Patch / Workaround · 2026-06-14: 1Technical Details · 2026-06-14: 1Technical Details · 2026-08-13: 106-1406-1808-13
Signal classification4 categories
Active Exploitation
240.0%
Patch
120.0%
PoC
120.0%
Disclosure
120.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-06-141
Patch1
2026-06-183
Active Exploitation2PoC1
2026-08-131
Disclosure1
Full discourse5 posts
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-53519 - critical 🚨 Nezha Dashboard < 2.0.13 - Path Traversal > Nezha Monitoring < 2.0.13 contains a path traversal caused by improper prefix checkin... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-53519 @pdnuclei #NucleiTemplates #cve

    Post summary

    Announces a critical path traversal in Nezha Dashboard versions below 2.0.13, pointing to a detection template, but provides no patch, PoC, or evidence of active exploitation.

    02071360
    1.3K followersView on X
  • Memento mori@envconfig
    Active Exploitation

    There's an article on the hacker forum "duty-free" discussing the hacking of thousands of VPS servers using CVE-2026-53519, and judging by the activity, it genuinely works - absolute madness... https://t.co/EwZ3ksySbf

    Post summary

    The forum post claims CVE‑2026‑53519 is being actively exploited against thousands of VPS servers, but offers no PoC, exploit code, patch details, or technical explanation, leaving the claim unverified yet seemingly credible.

    20020131
    24 followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-53519 Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute… https://www.cve.org/CVERecord?id=CVE-2026-53519

    Post summary

    CVE‑2026‑53519 is a flaw in Nezha Monitoring’s fallbackToFrontend before v2.0.13, which is fixed in that release; no PoC, exploit, or active exploitation is reported.

    01011155
    57.6K followersView on X
  • Memento mori@envconfig
    PoC

    The article shows how to read the config file, forge a JWT token, create an admin, and gain root access through the panel's terminal via the CVE-2026-53519 vulnerability in Nezha Monitoring

    Post summary

    The post details a proof‑of‑concept exploit for CVE-2026-53519 in Nezha Monitoring, showing how to manipulate config files and JWT tokens to gain root access.

    0000096
    24 followersView on X
  • D@heydenisetiawan
    Active Exploitation

    Proxmox dan Unraid kena compromised gara-gara nezha monitoring (CVE-2026-53519), terpaksa harus start-over setelah hampir 3 tahun running, sebuah kesalahan emang expose di host level :)

    Post summary

    The post claims that Proxmox and Unraid systems were compromised due to CVE-2026-53519, indicating the vulnerability is being exploited in the wild.

    0000056
    116 followersView on X

Explore more

Back to dashboard