Uptime Kuma CVE-2026-33130

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) assigns a score of 6.5, reflecting network-accessible attack surface, low attack complexity, low privilege requirement, and high confidentiality impact with no integrity or availability impact. The requirement for authenticated access (PR:L) significantly reduces real-world risk compared to unauthenticated exploits, as attackers must first obtain valid credentials or compromise an authorized user. However, the vulnerability is particularly dangerous in scenarios where Uptime Kuma is exposed to untrusted internal networks or where accounts have been compromised, as it enables direct access to sensitive files like configuration files, environment variables in /proc/self/environ, or SSH keys. The incomplete nature of the prior patch and the reliance on a side-effect (quote character failures) rather than explicit containment suggests this was a subtle bypass that may have been discovered through code review or variant analysis. Given the moderate CVSS score, authentication requirement, and file-read-only impact (no code execution), this presents a medium-priority remediation timeline, though organizations running Uptime Kuma in sensitive environments should prioritize patching.

An authenticated attacker with access to Uptime Kuma's notification configuration could inject a template payload containing an unquoted absolute path such as {{include '/etc/passwd'}} in a notification template field. This payload would bypass the initial path restrictions in notification-provider.js and successfully resolve through the require.resolve() fallback in liquid.node.js, allowing the attacker to read and exfiltrate the contents of /etc/passwd or other sensitive server files. The low attack complexity and lack of user interaction requirement (CVSS UI:N) mean this could be reliably exploited by any user with notification configuration privileges, making it a practical information disclosure attack in multi-tenant or compromised-credential scenarios.