OneUptime CVE-2026-30958

No special conditions - remote unauthenticated exploitation against default configurations of OneUptime prior to 10.0.21, because the /workflow/docs/:componentName endpoint has no authentication middleware and performs no path sanitization. The only practical limiters are: the instance must be network-reachable (internet-exposed or attacker on an adjacent network), and disclosed files are bounded to those readable by the OneUptime server process's OS user. No specific feature toggle or non-default setting is required.

The CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects a genuinely low-friction flaw: remote, network-reachable, no privileges, no user interaction, with a scope change because an unauthenticated web endpoint can read files across the server filesystem outside the application's authority. Confidentiality impact is high while integrity and availability are untouched, which is consistent with a read-only path-traversal primitive. Publicly available exploit code exists (referenced via the GitHub security advisory), raising practical risk for exposed instances. However, the EPSS score is very low at 0.05% (15th percentile), and the CVE is NOT on CISA KEV (no confirmed active exploitation), so the signals are mixed: trivially exploitable and POC-backed, but no evidence of widespread opportunistic exploitation yet - typical for a niche self-hosted product shortly after disclosure. The CVSS network/unauthenticated characterization is well-supported by the description (endpoint has no authentication middleware and concatenates the route parameter directly into res.sendFile()), so there is no AV conflict. Net: a real, actionable priority for anyone running an internet-exposed OneUptime instance below 10.0.21, but not a mass-exploitation emergency based on current EPSS/KEV evidence.

An attacker locates an internet-exposed OneUptime instance (prior to 10.0.21) and sends a crafted GET request to /workflow/docs/ with a traversal sequence (e.g. ../../../../etc/passwd) in the componentName parameter. Because the endpoint has no authentication and no path sanitization before res.sendFile(), the server returns arbitrary files readable by the process, such as configuration files containing secrets or credentials. Publicly available exploit code exists, lowering the skill required to weaponize this.