CVE-2026-53519 — Nezha Dashboard Path Traversal & JWT Forgery

English | 繁體中文 | 简体中文

This repository contains a Proof-of-Concept (PoC) exploit for a vulnerability in the Nezha Dashboard that allows unauthenticated path traversal, leading to disclosure of sensitive files (including jwt_secret_key) and enabling JWT token forgery for administrative access.

This issue is officially tracked in GitHub Security Advisory:
https://github.com/nezhahq/nezha/security/advisories/GHSA-5c25-7vpj-9mqh

As described in the advisory, the vulnerability stems from improper handling of dashboard routing and path normalization, allowing crafted requests such as: /dashboard../data/config.yaml

Exploit Chain

1. Path Traversal

   • Access internal configuration files via malformed /dashboard../ path.

2. Secret Extraction

   • Retrieve jwt_secret_key from config.yaml.

3. Database Access

   • Extract user IDs from sqlite.db.

4. JWT Forgery

   • Sign a valid token using the leaked secret.

5. Privilege Escalation

   • Gain control over the monitoring dashboard with administrative privileges.
   • Control connected agent nodes.

Usage

python3 exploit.py <url> [jwt_secret] [user_id]

Example

python3 exploit.py http://target.com

Screenshot

Disclaimer

This repository is provided strictly for educational, research, and authorized security testing purposes only.

The author does not condone or support unauthorized access, misuse, or illegal exploitation of software systems. This Proof-of-Concept (PoC) is intended to help security professionals, developers, and system administrators understand, reproduce, and remediate the described vulnerability in controlled environments.

By using this code, you agree that:

• You will only test it on systems you own or have explicit written permission to assess.
• You are solely responsible for any actions taken with this code.
• The author assumes no liability for any damage, data loss, or legal consequences resulting from misuse.
• This tool must not be used for malicious, intrusive, or unauthorized activity.