PT-2026-24254 · Oneuptime · Oneuptime

Iconnnjka · Published 2026-03-10 · Updated 2026-03-17 · CVE-2026-30958

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OneUptime versions prior to 10.0.21

Description OneUptime is a solution for monitoring and managing online services. A path traversal issue exists in the /workflow/docs/:componentName API endpoint, allowing unauthenticated reading of arbitrary files from the server filesystem. The componentName route parameter is directly concatenated into a file path and passed to the res.sendFile() function within the orker/FeatureSet/Workflow/Index.ts file without any sanitization or authentication checks.

Recommendations Update to version 10.0.21 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-30958

GHSA-P2WH-9PW8-HVFF

Affected Products

Oneuptime

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30958.json · Exploit
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-p2wh-9pw8-hvff · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30958 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30958 · Security Note
• https://github.com/OneUptime/oneuptime/releases/tag/10.0.21 · Note
• https://t.me/cveNotify/155276 · Telegram Post
• https://twitter.com/infoflowcloud/status/2033995745100021828 · Twitter Post
• https://twitter.com/dailycve/status/2032168482570174823 · Twitter Post
• https://twitter.com/CVEnew/status/2033994303748644965 · Twitter Post