PT-2026-26603 · Unknown · Uptime Kuma

Peaktwilight · Published 2025-10-20 · Updated 2026-03-22 · CVE-2026-33130

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Uptime Kuma versions 1.23.0 through 2.2.0

Description Uptime Kuma is an open source, self-hosted monitoring tool. Versions 1.23.0 through 2.2.0 do not fully implement the fix for GHSA-vffh-c9pq-4crh, leaving the application susceptible to Server-side Template Injection (SSTI). The mitigations added to the Liquid engine (root, relativeReference, dynamicPartials) only block paths enclosed in quotes. An attacker can bypass these mitigations by using unquoted absolute paths, allowing them to read any file on the server. The original fix in notification-provider.js only addresses the initial stages of file resolution in LiquidJS, but the require.resolve() fallback in liquid.node.js lacks containment checks. This allows unquoted absolute paths, such as /etc/passwd, to be successfully resolved. The blocking of quoted paths is a coincidental result of the quote characters causing a MODULE NOT FOUND error, rather than an intentional security measure.

Recommendations Update to Uptime Kuma version 2.2.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-36

CWE-98

CWE-1336

Related Identifiers

CVE-2026-33130

GHSA-V832-4R73-WX5J

GHSA-VFFH-C9PQ-4CRH

Affected Products

Uptime Kuma

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33130.json · Exploit
• https://github.com/louislam/uptime-kuma/security/advisories/GHSA-v832-4r73-wx5j · Vendor Advisory
• https://github.com/louislam/uptime-kuma/releases/tag/2.2.1 · Patch
• https://osv.dev/vulnerability/CVE-2026-33130 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vffh-c9pq-4crh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33130 · Security Note
• https://github.com/advisories/GHSA-vffh-c9pq-4crh · Vendor Advisory
• https://github.com/louislam/uptime-kuma · Note
• https://github.com/louislam/uptime-kuma/security/advisories/GHSA-vffh-c9pq-4crh · Note
• https://twitter.com/CVEnew/status/2035626991940977112 · Twitter Post