Louislam
Monthly
Path traversal in Dockge's stack name handling allows authenticated users to exfiltrate secrets from .env and Compose files belonging to any directory the server process can reach, and to recursively delete those directories. The flaw exists because validate() - which enforces a strict name allowlist - is only called from the save() code path; the socket handlers that service read and delete operations pass the raw user-supplied name directly to Stack.getStack without sanitization. Because Dockge routinely runs as root with access to the Docker socket, the reachable set encompasses the full host filesystem, not just managed stacks. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the bypass is mechanically trivial for any authenticated user.
Stored cross-site scripting in Uptime Kuma's Matomo analytics integration allows an admin or editor-level user to inject arbitrary JavaScript into every public status page by saving a crafted `siteId` value. The escaping pipeline in `server/analytics/matomo-analytics.js` - combining `jsesc` with `isScriptContext:true` and `html-escaper.escape()` - fails to neutralize JavaScript syntax characters (`]`, `)`, `;`, `(`), which are sufficient to break out of the `_paq.push(['setSiteId', ...])` expression context. Every unauthenticated visitor of any `/status/<slug>` page subsequently executes the attacker-controlled JavaScript, enabling session cookie theft and full page takeover. No public exploit has been independently confirmed, though the disclosure includes a functional proof-of-concept payload; no KEV listing exists at time of analysis.
Additional administrator account creation in Uptime Kuma through 2.5.8 allows unauthenticated attackers to obtain admin access to an instance that is still in its first-run setup state. Concurrent Socket.IO setup requests are timed to the bcrypt hashing window so the empty-user-table check passes more than once, after which the attacker can modify monitors and API keys and enable disableAuth. Exploitation is confined to unconfigured deployments with an empty user table and depends on a narrow timing race; no public exploit is identified at time of analysis, and the priority is this_month rather than immediate action.
Uptime Kuma versions 1.23.0 through 2.2.0 contain an incomplete Server-Side Template Injection (SSTI) vulnerability in the LiquidJS templating engine that allows authenticated attackers to read arbitrary files from the server. A prior fix (GHSA-vffh-c9pq-4crh) attempted to restrict file path access through three mitigation options (root, relativeReference, dynamicPartials), but this fix only blocks quoted paths; attackers can bypass the mitigation by using unquoted absolute paths like /etc/passwd that successfully resolve through the require.resolve() fallback mechanism in liquid.node.js. The vulnerability requires low privileges (authenticated access) but can result in high confidentiality impact, making it a notable information disclosure risk for self-hosted monitoring deployments.
Path traversal in Dockge's stack name handling allows authenticated users to exfiltrate secrets from .env and Compose files belonging to any directory the server process can reach, and to recursively delete those directories. The flaw exists because validate() - which enforces a strict name allowlist - is only called from the save() code path; the socket handlers that service read and delete operations pass the raw user-supplied name directly to Stack.getStack without sanitization. Because Dockge routinely runs as root with access to the Docker socket, the reachable set encompasses the full host filesystem, not just managed stacks. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the bypass is mechanically trivial for any authenticated user.
Stored cross-site scripting in Uptime Kuma's Matomo analytics integration allows an admin or editor-level user to inject arbitrary JavaScript into every public status page by saving a crafted `siteId` value. The escaping pipeline in `server/analytics/matomo-analytics.js` - combining `jsesc` with `isScriptContext:true` and `html-escaper.escape()` - fails to neutralize JavaScript syntax characters (`]`, `)`, `;`, `(`), which are sufficient to break out of the `_paq.push(['setSiteId', ...])` expression context. Every unauthenticated visitor of any `/status/<slug>` page subsequently executes the attacker-controlled JavaScript, enabling session cookie theft and full page takeover. No public exploit has been independently confirmed, though the disclosure includes a functional proof-of-concept payload; no KEV listing exists at time of analysis.
Additional administrator account creation in Uptime Kuma through 2.5.8 allows unauthenticated attackers to obtain admin access to an instance that is still in its first-run setup state. Concurrent Socket.IO setup requests are timed to the bcrypt hashing window so the empty-user-table check passes more than once, after which the attacker can modify monitors and API keys and enable disableAuth. Exploitation is confined to unconfigured deployments with an empty user table and depends on a narrow timing race; no public exploit is identified at time of analysis, and the priority is this_month rather than immediate action.
Uptime Kuma versions 1.23.0 through 2.2.0 contain an incomplete Server-Side Template Injection (SSTI) vulnerability in the LiquidJS templating engine that allows authenticated attackers to read arbitrary files from the server. A prior fix (GHSA-vffh-c9pq-4crh) attempted to restrict file path access through three mitigation options (root, relativeReference, dynamicPartials), but this fix only blocks quoted paths; attackers can bypass the mitigation by using unquoted absolute paths like /etc/passwd that successfully resolve through the require.resolve() fallback mechanism in liquid.node.js. The vulnerability requires low privileges (authenticated access) but can result in high confidentiality impact, making it a notable information disclosure risk for self-hosted monitoring deployments.