What is the CVSS score of EUVD-2026-53370?

EUVD-2026-53370 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Uptime Kuma are affected by EUVD-2026-53370?

Uptime Kuma's Matomo analytics integration contains a high-severity stored XSS vulnerability (CVE-2026-71285, CVSS 8.1) with publicly available exploit code and no vendor-released patch identified at…

How to fix or mitigate EUVD-2026-53370?

Within 24 hours: Disable the Matomo analytics integration in all Uptime Kuma deployments, review audit logs for unauthorized changes to Matomo settings, and restrict administrative and editor access to essential personnel only. Within 7 days: Reset credentials for all users with admin or editor roles, implement role-based access controls limiting Matomo configuration changes to a minimal administrative group, and audit all status page configurations for evidence of compromise. Within 30 days: Monitor vendor advisories for a patched version of Uptime Kuma addressing CVE-2026-71285 and upgrade immediately upon release; conduct a comprehensive security assessment of all Uptime Kuma instances and their third-party integrations.

Uptime Kuma EUVD-2026-53370

| CVE-2026-71285 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-05 TuranSec

GHSA-pf4v-rpp4-fp6r

XSS Uptime Kuma Louislam

8.1

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Admin credentials required to configure siteId (PR:H); stored XSS crosses scope to victim browsers (S:C/UI:R); cookie theft and DOM takeover justify C:H/I:H; no availability impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:45 vuln.today

CVE Published

Aug 05, 2026 - 12:26 cve.org

HIGH 8.1

DescriptionCVE.org

Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo siteId value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page: _paq.push(['setSiteId', ${escapedSiteIdHTMLAttribute}]);. The escaping pipeline used (jsesc with isScriptContext:true, then html-escaper.escape()) does not escape the characters ], ), ;, (, which are sufficient to break out of the array/push expression context. A siteId value such as 1]);alert(document.cookie)//, once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/<slug> page, enabling session-cookie theft and full page takeover.

AnalysisAI

Stored cross-site scripting in Uptime Kuma's Matomo analytics integration allows an admin or editor-level user to inject arbitrary JavaScript into every public status page by saving a crafted siteId value. The escaping pipeline in server/analytics/matomo-analytics.js - combining jsesc with isScriptContext:true and html-escaper.escape() - fails to neutralize JavaScript syntax characters (], ), ;, (), which are sufficient to break out of the _paq.push(['setSiteId', ...]) expression context. Every unauthenticated visitor of any /status/<slug> page subsequently executes the attacker-controlled JavaScript, enabling session cookie theft and full page takeover. No public exploit has been independently confirmed, though the disclosure includes a functional proof-of-concept payload; no KEV listing exists at time of analysis.

Technical ContextAI

Uptime Kuma (cpe:2.3:a:louislam:uptime-kuma:*:*:*:*:*:*:*:*) is a self-hosted, open-source uptime monitoring tool. Its Matomo analytics integration (server/analytics/matomo-analytics.js) renders the admin-configured siteId directly into a <script> block via template literal: _paq.push(['setSiteId', ${escapedSiteIdHTMLAttribute}]);. The escaping pipeline applies jsesc (configured for script context) followed by html-escaper.escape(), which together neutralize HTML-special characters and some Unicode sequences but leave JavaScript punctuation - specifically ], ), ;, and ( - unescaped. Because siteId is placed inside a JavaScript array-push expression without numeric type enforcement or JSON encoding, these unescaped characters are sufficient to terminate the enclosing array literal and function call, then inject arbitrary statements. This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) rooted in an inadequate escaping strategy for a JavaScript inline-script context, compounded by the absence of input validation enforcing that siteId must be a numeric integer.

RemediationAI

No vendor-released patch or fixed version has been identified at time of analysis - available references point only to the upstream project repository (https://github.com/louislam/uptime-kuma) and the vulnerable source file, with no tagged release or advisory confirming a fix. As an immediate compensating control, administrators should disable the Matomo analytics integration entirely within Uptime Kuma settings, removing the injection surface with no impact on core monitoring, alerting, or status page functionality. If Matomo integration is operationally required, access to the Uptime Kuma administrative panel should be restricted at the network layer (firewall rules, reverse-proxy authentication, VPN requirement) to the smallest possible set of trusted principals, reducing the pool of accounts capable of saving a malicious siteId - though this does not eliminate insider threat. The correct long-term fix requires enforcing that siteId is a valid positive integer at the server-side before template injection, or replacing the current escaping pipeline with strict JSON encoding (e.g., JSON.stringify(siteId)) to ensure the value is always treated as a JavaScript string or number literal with no context-breakout potential.