Uptime Kuma
Monthly
Stored cross-site scripting in Uptime Kuma's Matomo analytics integration allows an admin or editor-level user to inject arbitrary JavaScript into every public status page by saving a crafted `siteId` value. The escaping pipeline in `server/analytics/matomo-analytics.js` - combining `jsesc` with `isScriptContext:true` and `html-escaper.escape()` - fails to neutralize JavaScript syntax characters (`]`, `)`, `;`, `(`), which are sufficient to break out of the `_paq.push(['setSiteId', ...])` expression context. Every unauthenticated visitor of any `/status/<slug>` page subsequently executes the attacker-controlled JavaScript, enabling session cookie theft and full page takeover. No public exploit has been independently confirmed, though the disclosure includes a functional proof-of-concept payload; no KEV listing exists at time of analysis.
Additional administrator account creation in Uptime Kuma through 2.5.8 allows unauthenticated attackers to obtain admin access to an instance that is still in its first-run setup state. Concurrent Socket.IO setup requests are timed to the bcrypt hashing window so the empty-user-table check passes more than once, after which the attacker can modify monitors and API keys and enable disableAuth. Exploitation is confined to unconfigured deployments with an empty user table and depends on a narrow timing race; no public exploit is identified at time of analysis, and the priority is this_month rather than immediate action.
Uptime Kuma versions 1.23.0 through 2.2.0 contain an incomplete Server-Side Template Injection (SSTI) vulnerability in the LiquidJS templating engine that allows authenticated attackers to read arbitrary files from the server. A prior fix (GHSA-vffh-c9pq-4crh) attempted to restrict file path access through three mitigation options (root, relativeReference, dynamicPartials), but this fix only blocks quoted paths; attackers can bypass the mitigation by using unquoted absolute paths like /etc/passwd that successfully resolve through the require.resolve() fallback mechanism in liquid.node.js. The vulnerability requires low privileges (authenticated access) but can result in high confidentiality impact, making it a notable information disclosure risk for self-hosted monitoring deployments.
Uptime Kuma is an easy-to-use self-hosted monitoring tool. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Uptime Kuma is an easy-to-use self-hosted monitoring tool. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Uptime Kuma is an open source self-hosted monitoring tool. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Uptime Kuma is a self-hosted monitoring tool. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross Site Scripting vulnerability found in : louislam Uptime Kuma v.1.19.6 and before allows a remote attacker to execute arbitrary commands via the description, title, footer, and incident creation. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Uptime Kuma is a self-hosted monitoring tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Uptime Kuma is a self-hosted monitoring tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting in Uptime Kuma's Matomo analytics integration allows an admin or editor-level user to inject arbitrary JavaScript into every public status page by saving a crafted `siteId` value. The escaping pipeline in `server/analytics/matomo-analytics.js` - combining `jsesc` with `isScriptContext:true` and `html-escaper.escape()` - fails to neutralize JavaScript syntax characters (`]`, `)`, `;`, `(`), which are sufficient to break out of the `_paq.push(['setSiteId', ...])` expression context. Every unauthenticated visitor of any `/status/<slug>` page subsequently executes the attacker-controlled JavaScript, enabling session cookie theft and full page takeover. No public exploit has been independently confirmed, though the disclosure includes a functional proof-of-concept payload; no KEV listing exists at time of analysis.
Additional administrator account creation in Uptime Kuma through 2.5.8 allows unauthenticated attackers to obtain admin access to an instance that is still in its first-run setup state. Concurrent Socket.IO setup requests are timed to the bcrypt hashing window so the empty-user-table check passes more than once, after which the attacker can modify monitors and API keys and enable disableAuth. Exploitation is confined to unconfigured deployments with an empty user table and depends on a narrow timing race; no public exploit is identified at time of analysis, and the priority is this_month rather than immediate action.
Uptime Kuma versions 1.23.0 through 2.2.0 contain an incomplete Server-Side Template Injection (SSTI) vulnerability in the LiquidJS templating engine that allows authenticated attackers to read arbitrary files from the server. A prior fix (GHSA-vffh-c9pq-4crh) attempted to restrict file path access through three mitigation options (root, relativeReference, dynamicPartials), but this fix only blocks quoted paths; attackers can bypass the mitigation by using unquoted absolute paths like /etc/passwd that successfully resolve through the require.resolve() fallback mechanism in liquid.node.js. The vulnerability requires low privileges (authenticated access) but can result in high confidentiality impact, making it a notable information disclosure risk for self-hosted monitoring deployments.
Uptime Kuma is an easy-to-use self-hosted monitoring tool. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Uptime Kuma is an easy-to-use self-hosted monitoring tool. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Uptime Kuma is an open source self-hosted monitoring tool. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Uptime Kuma is a self-hosted monitoring tool. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross Site Scripting vulnerability found in : louislam Uptime Kuma v.1.19.6 and before allows a remote attacker to execute arbitrary commands via the description, title, footer, and incident creation. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Uptime Kuma is a self-hosted monitoring tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Uptime Kuma is a self-hosted monitoring tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.