CVE-2026-111385

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

EUVD-2026-102566

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

CVE-2026-111385

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

CVE-2026-111385 Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

CVE-2026-111385 Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

CVE-2026-111385

Nezha versions 2.1.0 before 2.3.15 are vulnerable to a Host Header Injection in the mintTransferTool component. The vulnerability occurs because the application builds fs.download_url and fs.upload_url transfer URLs using an unvalidated Host header . An attacker controlling the Host header in a v...

CVE-2026-111385 Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

CVE-2026-111385: URL Redirection to Untrusted Site

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

PT-2026-115391

Name of the Vulnerable Software and Affected Versions Nezha versions 2.1.0 through 2.3.14 Description The mintTransferTool component fails to validate the Host header when constructing fs.download url and fs.upload url transfer URLs. This allows an attacker to control the Host header in a victim'...

Nezhahq Nezha: Input validation error vulnerability

Versions of Nezhahq Nezha from 2.1.0 to 2.3.15 had a vulnerability related to input validation errors. This vulnerability occurred because the mintTransferTool never validated the construction of Host headers for the fs.downloadurl and fs.uploadurl URLs. This could allow attackers to redirect fil...