What is the CVSS score of CVE-2026-33130?

CVE-2026-33130 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33130?

Organizations using versions 1.23.0 should be aware of notable risk from CVE-2026-33130 rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-33130?

Within 30 days: Identify affected systems running versions 1.23.0 and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-33130

EUVD-2026-13670 MEDIUM

PHP Remote File Inclusion (CWE-98)

2026-03-20 GitHub_M

PHP Node.js LFI Code Injection Uptime Kuma Louislam

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.2.1

EUVD ID Assigned

Mar 20, 2026 - 10:00 euvd

EUVD-2026-13670

Analysis Generated

Mar 20, 2026 - 10:00 vuln.today

CVE Published

Mar 20, 2026 - 09:50 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection (SSTI). The three mitigations added to the Liquid engine (root, relativeReference, dynamicPartials) only block quoted paths. If a project uses an unquoted absolute path, attackers can still read any file on the server. The original fix in notification-provider.js only constrains the first two steps of LiquidJS's file resolution (via root, relativeReference, and dynamicPartials options), but the third step, the require.resolve() fallback in liquid.node.js has no containment check, allowing unquoted absolute paths like /etc/passwd to resolve successfully. Quoted paths happen to be blocked only because the literal quote characters cause require.resolve('"/etc/passwd"') to throw a MODULE_NOT_FOUND error, not because of any intentional security measure. This issue has been fixed in version 2.2.1.

AnalysisAI

Uptime Kuma versions 1.23.0 through 2.2.0 contain an incomplete Server-Side Template Injection (SSTI) vulnerability in the LiquidJS templating engine that allows authenticated attackers to read arbitrary files from the server. A prior fix (GHSA-vffh-c9pq-4crh) attempted to restrict file path access through three mitigation options (root, relativeReference, dynamicPartials), but this fix only blocks quoted paths; attackers can bypass the mitigation by using unquoted absolute paths like /etc/passwd that successfully resolve through the require.resolve() fallback mechanism in liquid.node.js. The vulnerability requires low privileges (authenticated access) but can result in high confidentiality impact, making it a notable information disclosure risk for self-hosted monitoring deployments.

Technical ContextAI

The vulnerability exists in Uptime Kuma's use of the LiquidJS templating engine (a Node.js implementation of Shopify's Liquid template language) within the notification provider system. The root cause, classified as CWE-98 (Improper Control of Filename for Include/Require Statement in Program), stems from an incomplete implementation of file path constraints in notification-provider.js. The initial mitigation added three LiquidJS configuration options (root, relativeReference, dynamicPartials) intended to restrict template file resolution, but these options only prevent path traversal when paths are quoted. The third-stage file resolution mechanism in liquid.node.js uses Node.js's require.resolve() function without any containment checks, allowing unquoted absolute paths to bypass the first two stages of constraint. Quoted paths appear secured only incidentally because literal quote characters in the path argument cause require.resolve('"/etc/passwd"') to fail with MODULE_NOT_FOUND, not due to intentional security design. The affected product is Uptime Kuma (cpe:2.3:a:louislam:uptime-kuma:*:*:*:*:*:*:*:*), an open-source Node.js-based self-hosted monitoring tool.

RemediationAI

Upgrade Uptime Kuma to version 2.2.1 or later immediately, as this version includes the complete fix for the LiquidJS file path containment issue (see https://github.com/louislam/uptime-kuma/releases/tag/2.2.1). For organizations unable to patch immediately, restrict network access to the Uptime Kuma instance to trusted administrative networks only, limit notification template usage to non-sensitive data, and audit all configured notification providers to ensure they do not include user-controlled template content. Additionally, review access control for Uptime Kuma user accounts and revoke credentials for any accounts that are not actively needed, since the vulnerability requires authenticated access. Monitor file access logs on the server for any suspicious access patterns targeting sensitive system files like /etc/passwd or configuration directories.