A pre‑authentication path traversal flaw exists in Nezha Monitoring. By crafting a URL that starts with "/dashboard" followed by two dots and a directory traversal payload, an unauthenticated user can cause the server to serve the file "/data/config.yaml". The configuration file contains the jwt_secret_key, exposing sensitive secrets to the attacker.

Nezha Monitoring deployments of nezhahq:nezha earlier than version 2.0.13 are vulnerable. Any installed instance using the default asset routing without authentication can be impacted.

The vulnerability has a CVSS score of 9.1, indicating a high level of severity. The EPSS score is 2%, and the attack requires only network access to the monitoring web interface; this attack vector is inferred from the description and is not explicitly stated. The likely attack vector is a remote actor sending a crafted URL to the monitoring web interface over HTTP/HTTPS. It is not listed in the CISA KEV catalog and no public exploits have been reported, yet the lack of authentication and the path traversal logic make it a prime target for attackers seeking to steal configuration secrets.