Louislam
Monthly
Path traversal in Dockge's stack name handling allows authenticated users to exfiltrate secrets from .env and Compose files belonging to any directory the server process can reach, and to recursively delete those directories. The flaw exists because validate() - which enforces a strict name allowlist - is only called from the save() code path; the socket handlers that service read and delete operations pass the raw user-supplied name directly to Stack.getStack without sanitization. Because Dockge routinely runs as root with access to the Docker socket, the reachable set encompasses the full host filesystem, not just managed stacks. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the bypass is mechanically trivial for any authenticated user.
Stored cross-site scripting in Uptime Kuma's Matomo analytics integration allows an admin or editor-level user to inject arbitrary JavaScript into every public status page by saving a crafted `siteId` value. The escaping pipeline in `server/analytics/matomo-analytics.js` - combining `jsesc` with `isScriptContext:true` and `html-escaper.escape()` - fails to neutralize JavaScript syntax characters (`]`, `)`, `;`, `(`), which are sufficient to break out of the `_paq.push(['setSiteId', ...])` expression context. Every unauthenticated visitor of any `/status/<slug>` page subsequently executes the attacker-controlled JavaScript, enabling session cookie theft and full page takeover. No public exploit has been independently confirmed, though the disclosure includes a functional proof-of-concept payload; no KEV listing exists at time of analysis.
Uptime Kuma versions 1.23.0 through 2.2.0 contain an incomplete Server-Side Template Injection (SSTI) vulnerability in the LiquidJS templating engine that allows authenticated attackers to read arbitrary files from the server. A prior fix (GHSA-vffh-c9pq-4crh) attempted to restrict file path access through three mitigation options (root, relativeReference, dynamicPartials), but this fix only blocks quoted paths; attackers can bypass the mitigation by using unquoted absolute paths like /etc/passwd that successfully resolve through the require.resolve() fallback mechanism in liquid.node.js. The vulnerability requires low privileges (authenticated access) but can result in high confidentiality impact, making it a notable information disclosure risk for self-hosted monitoring deployments.
Path traversal in Dockge's stack name handling allows authenticated users to exfiltrate secrets from .env and Compose files belonging to any directory the server process can reach, and to recursively delete those directories. The flaw exists because validate() - which enforces a strict name allowlist - is only called from the save() code path; the socket handlers that service read and delete operations pass the raw user-supplied name directly to Stack.getStack without sanitization. Because Dockge routinely runs as root with access to the Docker socket, the reachable set encompasses the full host filesystem, not just managed stacks. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the bypass is mechanically trivial for any authenticated user.
Stored cross-site scripting in Uptime Kuma's Matomo analytics integration allows an admin or editor-level user to inject arbitrary JavaScript into every public status page by saving a crafted `siteId` value. The escaping pipeline in `server/analytics/matomo-analytics.js` - combining `jsesc` with `isScriptContext:true` and `html-escaper.escape()` - fails to neutralize JavaScript syntax characters (`]`, `)`, `;`, `(`), which are sufficient to break out of the `_paq.push(['setSiteId', ...])` expression context. Every unauthenticated visitor of any `/status/<slug>` page subsequently executes the attacker-controlled JavaScript, enabling session cookie theft and full page takeover. No public exploit has been independently confirmed, though the disclosure includes a functional proof-of-concept payload; no KEV listing exists at time of analysis.
Uptime Kuma versions 1.23.0 through 2.2.0 contain an incomplete Server-Side Template Injection (SSTI) vulnerability in the LiquidJS templating engine that allows authenticated attackers to read arbitrary files from the server. A prior fix (GHSA-vffh-c9pq-4crh) attempted to restrict file path access through three mitigation options (root, relativeReference, dynamicPartials), but this fix only blocks quoted paths; attackers can bypass the mitigation by using unquoted absolute paths like /etc/passwd that successfully resolve through the require.resolve() fallback mechanism in liquid.node.js. The vulnerability requires low privileges (authenticated access) but can result in high confidentiality impact, making it a notable information disclosure risk for self-hosted monitoring deployments.